- Published on
MAYAChain halts network after estimated $1.7M exploit
- Authors
- Name
- DeepHorus
Cross-chain decentralized exchange MAYAChain has halted its network following an exploit that drained an estimated $1.7 million in crypto assets. The protocol’s pseudonymous co-founder, Aalux, announced the emergency halt on Wednesday, confirming that the attacker stole roughly 20 Bitcoin, valued at $1.4 million, along with an additional $300,000 in other assets. Aalux stated that the global halt contained further damage and that the team is actively working on a fix to safely resume swaps.
The exploit marks another significant blow to the decentralized finance (DeFi) sector, which has seen a rising tide of sophisticated attacks in recent months. MAYAChain, known for its cross-chain capabilities that allow users to swap assets across different blockchains without a central intermediary, became the latest victim of a vulnerability chain that bypassed its security measures. The incident underscores the persistent risks inherent in complex smart contract systems.
According to a preliminary technical analysis shared by Aalux, the attack exploited six chained bugs involving trade accounts, outbound transaction handling, and liquidity pool calculations. The attacker executed a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool, and then withdraw 48.87 million CACAO tokens from MAYAChain's Asgard module. The report calculated that approximately $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on the network.
Independent blockchain security researcher Vini Barbosa summarized the findings, highlighting that CACAO, MAYAChain's native token, plunged by 88.7% during the incident, falling from roughly $0.115 to $0.013. Barbosa noted that the analysis estimated a broader $10.9 million decline in pool value, but clarified that this figure included arbitrage activity and the token's devaluation rather than assets stolen solely by the attacker. This distinction suggests that market panic and automated trading amplified the overall impact.
The immediate impact on users was severe, as swaps were frozen and many liquidity providers faced significant losses. CACAO holders saw the value of their assets evaporate in minutes, and the network's reputation for secure cross-chain trading has been called into question. The halt, while necessary to prevent further loss, has also stranded funds in smart contracts, leaving users in limbo until the fix is implemented.
Reactions from the crypto community have been mixed, with some praising MAYAChain's quick response to halt the network and contain damage, while others criticized the protocol for inadequate auditing. Security researcher Vini Barbosa’s breakdown of the chained bugs has sparked discussions about the need for more rigorous testing of DeFi protocols. Analysts point out that a single transaction with 23 messages exploiting multiple vulnerabilities reveals a systemic lack of defense-in-depth.
Looking ahead, MAYAChain plans to deploy a fix and resume operations, but the timeline remains unclear. The team will likely conduct a post-mortem and may consider compensating affected users, though no commitments have been made yet. This incident adds to a growing list of DeFi exploits in 2025, reinforcing the urgent need for enhanced security standards, formal verification, and bug bounty programs across the ecosystem.
In a broader context, this hack highlights the evolving sophistication of attackers who now chain multiple minor flaws into a devastating exploit. As cross-chain protocols become more complex, the attack surface expands, and the industry must prioritize security at every layer. The MAYAChain incident serves as a stark reminder that even well-established platforms are not immune, and that constant vigilance and proactive measures are essential to safeguard user funds in the rapidly evolving DeFi landscape.
