Cross-chain liquidity protocol Maya Protocol has suffered an exploit that drained nearly $1.7 million in Bitcoin and other assets, while the total value lost from its liquidity pools reached about $11 million.
The attack began after a series of software bugs created a false balance in one of MAYAChain’s liquidity pools. The attacker used the distorted balance to gain more than 99% control of the pool and withdraw millions of CACAO tokens, which were then exchanged for Bitcoin, Ether and other assets.
Sad news 😕
Will work to fix and recover in full. We carry on. @Maya_Protocol pic.twitter.com/EYK9BeWWLI— Aaluxx⚡️🍫🛡️ (@AaluxxMyth) August 18, 2026
MAYAChain halted trading after detecting the exploit in an attempt to contain the damage. According to the creator of the protocol, the attacker stole around 20 Bitcoin, which at the time was worth about $1.4 million, in addition to about $300,000 in other assets.
Six other vulnerabilities combined to generate the vulnerability, according to a technical reconstruction of the assault.
The incident began when MAYAChain incorrectly concluded that an outgoing transaction had gone missing. The network then activated a mechanism designed to compensate a liquidity pool after a suspected theft.
However, the compensation calculation was wrong. The system added around 49 million CACAO to a small pool even though the network’s reserve contained only about 168,000 CACAO and could not actually fund the payment.
The transfer itself failed, but another software bug meant that the inflated balance had already been recorded in the network’s records. The failed transaction did not properly reverse the change.
The attacker then deposited a very small amount into the distorted pool. Because the system believed the pool contained tens of millions of CACAO, the attacker ended up controlling more than 99% of it.
The attacker started exchanging the tokens for Bitcoin, Ether, and other assets kept in MAYAChain’s liquidity pools as soon as they took out about 48.87 million CACAO.
The attacker’s Bitcoin address received around 20.83 BTC, or nearly $1.34 million, according to on-chain records. An additional $1.36 million worth of assets were transferred to other blockchains.
The CACAO token then collapsed as the attacker and other traders sold into the market. The token had been trading at around $0.115 before the exploit but fell as low as $0.013, representing a decline of nearly 89%, before recovering somewhat.
The fall in CACAO’s price caused losses far beyond the assets directly taken by the attacker.
As the token became heavily discounted, arbitrage traders bought CACAO and exchanged it for Bitcoin, Ether, stablecoins and other assets in MAYAChain’s pools. This reduced the value of assets available to ordinary liquidity providers.
The technical analysis estimated that the attacker personally extracted around $1.65 million, including tokens that remained on the network. However, the total decline in pool value was estimated at about $10.9 million.
That larger figure should not be interpreted as the amount stolen. Around $6.4 million of the decline was attributed to CACAO losing value, while approximately $2.9 million resulted from traders taking advantage of the price difference.
MAYAChain has said it hopes the attacker will return the funds in exchange for a bug bounty. The team has also said it may seek to replace the missing Bitcoin through investments in Aztec Chain and other measures if the funds are not returned.
The incident highlights the risks faced by decentralised liquidity protocols. A single software error can sometimes have consequences far beyond the initial exploit, especially when the affected token is deeply connected to multiple liquidity pools.
Fixing the underlying software will therefore be only part of the recovery. Maya Protocol will also have to address the losses suffered by liquidity providers and restore confidence in the network.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment