Summary
- Maya Protocol has paused its MAYAChain after an attacker exploited six vulnerabilities, leading to the theft of approximately $1.7 million in Bitcoin and other assets.
- A detailed analysis revealed six bugs that caused inflated balances in a liquidity pool.
- As a result, the value of MAYAChain's liquidity pools decreased by about $10.9 million, causing CACAO to drop nearly 89%.
Maya Protocol, a cross-chain liquidity platform, has halted its operations as of Tuesday after an attacker exploited multiple software vulnerabilities to siphon off around $1.7 million in Bitcoin and additional assets.
In a message on X, founder AaluxxMyth, also known simply as Maya, stated that the network was paused to mitigate the damage and that the team would address the vulnerabilities before resuming operations.
Myriad: What’s Bitcoin’s next move? Make your prediction here.Maya commented, "There’s no way to sugar coat this. We have likely been exploited for 20 BTC ($1.4 million) and other assets totaling around $300,000."
The protocol operates on MAYAChain, a decentralized platform that facilitates cryptocurrency swaps, including Bitcoin and Ethereum, across different blockchains without the need for centralized exchanges.
“This exploit has tested our resilience. Our focus is on solutions, actions, and rebuilding,” Maya stated. “We are deeply grateful for the unwavering support from the Maya tribe.” ❤️… https://t.co/xxkzprEscO
— Maya Protocol (@Maya_Protocol) August 19, 2026
A post-incident report from the Maya Protocol team indicated that the attacker took advantage of six bugs to inflate a liquidity pool by 49.45 million CACAO, subsequently gaining 99.93% control and withdrawing 48.87 million CACAO.
According to the report, “The attack utilized a single MsgDeposit transaction comprised of 23 messages to trigger a false theft detection, inflate a low-liquidity pool's CACAO balance through an uncapped slash subsidy, and then withdraw from this inflated pool.”
As the attacker exchanged tokens for Bitcoin and other assets, the price of CACAO plummeted, which limited the total amount extracted. The team estimates the attacker stole around $1.65 million in cryptocurrency, with approximately $1.36 million transferred to external blockchains and about $291,000 remaining on-chain.
The team did not confirm if artificial intelligence was involved in the attack. They noted that the vulnerabilities had gone unnoticed for three to four years despite audits by Halborn and Fable 5, stressing the need for a more adversarial code review process.
“We must adopt an even more adversarial stance and focus on very basic code primitives,” Maya emphasized in a follow-up post. “We were aware of the challenges ahead, but our mission remains worthwhile.”
Maya Protocol has shared the suspected attacker's Bitcoin address, which received 20.83 BTC valued at about $1.34 million. The team estimates the total loss at approximately $1.65 million and expressed hopes for the funds to be returned in exchange for a bug bounty.
If recovery efforts are unsuccessful, Maya plans to reclaim the 20 BTC through investments in Aztec Chain and other means, intending to return it to the affected liquidity pool.
This incident follows a series of significant DeFi exploits in recent months, including a $292 million theft from KelpDAO's cross-chain bridge in April due to a social engineering attack, and other losses in July amounting to $18 million from Ostium and $24 million from AFX Trade due to oracle manipulations and bridge exploits, respectively.