Maya Protocol Exploit Drains $1.7 Million, Triggers $11 Million in Total Pool Losses

Cross-chain liquidity protocol Maya Protocol halted its MAYAChain network after a chain of six software bugs allowed an attacker to drain roughly $1.7 million in bitcoin and other assets, triggering broader losses of about $11 million across its liquidity pools. Founder AaluxxMyth confirmed on social media that the exploit resulted in a loss of 20 BTC, worth around $1.4 million, plus roughly $300,000 in other assets, and said trading has been paused while the team works on a fix.

How the Bookkeeping Error Happened

MAYAChain, a smaller network enabling asset swaps like bitcoin and ether without centralized exchanges, mistakenly flagged an outgoing transaction as missing and triggered a compensation mechanism meant to reimburse a liquidity pool. That mechanism miscalculated the payout, crediting roughly 49 million CACAO tokens to a pool that only held about 168,000 CACAO in reserve. The transfer itself failed, but a separate bug caused the inflated balance to remain recorded anyway.

Attacker Exploits the Fake Balance

Taking advantage of the error, the attacker deposited a small amount into the distorted pool, gaining ownership of over 99% of it, then withdrew 48.87 million CACAO and swapped it for bitcoin, ether, and other assets. On-chain data shows about 20.83 BTC, worth roughly $1.34 million, was sent to the attacker’s wallet, with additional CACAO still held on-chain.

CACAO Price Collapses, Amplifying Losses

CACAO’s price fell from around $0.115 to as low as $0.013, an 89% drop, before partially recovering to around $0.03. As the token crashed, arbitrage traders bought the discounted CACAO and swapped it for other assets in MAYAChain’s pools, deepening the damage. Of the estimated $10.9 million total pool losses, roughly $6.4 million stemmed from CACAO’s price collapse and $2.9 million from arbitrage activity, separate from the attacker’s direct $1.65 million extraction.

Recovery Efforts Underway

Maya Protocol said it hopes the attacker will return the funds in exchange for a bug bounty, and plans to explore replacing the lost bitcoin through investments in Aztec Chain if the funds aren’t recovered. However, much of the exploited CACAO has already mixed with legitimate liquidity provider funds across other markets, complicating full recovery.