What to Know

  • Maya Protocol halted its MAYAChain network after an exploit tied to a chain of six software bugs.
  • The attacker drained about $1.7 million in bitcoin and other assets, including 20 BTC valued at about $1.4 million and roughly $300,000 in other assets.
  • A technical reconstruction found that MAYAChain credited a liquidity pool with roughly 49 million CACAO that was not properly funded.
  • The network reserve held only about 168,000 CACAO, leaving it unable to support the incorrectly calculated compensation.
  • The attacker deposited a tiny amount into the distorted pool, gained more than 99% of it, and withdrew 48.87 million CACAO.
  • On-chain records show 20.83 BTC worth about $1.34 million was sent to the attacker’s bitcoin address.
  • CACAO fell from around $0.115 to as low as $0.013, a drop of nearly 89%, before recovering to around $0.03.
  • The estimated decline in MAYAChain liquidity-pool value was about $10.9 million, including effects from arbitrage and the CACAO price collapse.
  • Maya Protocol said it hopes the attacker returns funds in exchange for a bug bounty and said it may work to replace roughly 20 BTC through investments in Aztec Chain and other means if funds are not returned.

Maya Protocol Freezes MAYAChain After Cross-Chain Exploit

Maya Protocol halted MAYAChain after an attacker chained together multiple software flaws to manipulate the network’s internal accounting and drain real crypto assets from its liquidity pools. The incident hit one of the more sensitive areas of decentralized finance: cross-chain swaps, where users rely on automated pools and protocol logic to move value between assets such as bitcoin and ether without routing trades through a centralized exchange.

The halt was a containment measure after the network credited a pool with tokens that had not been properly funded. That false balance allowed an attacker to treat an inflated pool position as real and exchange the resulting tokens for assets sitting elsewhere in MAYAChain’s liquidity system. The direct amount extracted by the attacker was estimated at about $1.65 million to $1.7 million, while the wider hit to pool value was estimated at about $10.9 million.

The event also triggered a steep selloff in CACAO, the common asset used to connect markets across the Maya ecosystem. CACAO traded around $0.115 before the exploit, fell as low as $0.013, and later recovered to around $0.03. That near 89% drop amplified the damage because the token’s price decline changed the value of assets across MAYAChain pools and opened the door for arbitrage traders to exploit price gaps.

How the False Balance Was Created

The exploit began with MAYAChain mistakenly treating an outgoing transaction as missing. That triggered code designed to compensate a liquidity pool after a theft. In principle, such a mechanism is meant to protect liquidity providers when the network identifies a loss. In this case, however, the safety logic became part of the attack path because the calculation and follow-up handling failed in sequence.

The compensation calculation added roughly 49 million CACAO to a small pool even though the network reserve held only about 168,000 CACAO. That meant the system’s accounting reflected a much larger token balance than the reserve could actually fund. The transfer itself failed, but another bug meant the inflated balance had already been saved in MAYAChain’s records.

Instead of reverting the incorrect balance after the failed transfer, the chain continued as though the pool genuinely contained the extra CACAO. This distinction is critical: the attacker did not need to break every part of the system individually. The damaging outcome emerged because a false theft alert, faulty handling of an outgoing transaction, and flawed liquidity-pool calculations interacted in the wrong order.

Technical traders and protocol analysts often describe this kind of episode as a composability failure inside the software itself. Each bug may look narrow in isolation, but when several execution paths overlap, the combined effect can be far larger than any single defect would suggest. In MAYAChain’s case, the result was a pool that appeared dramatically richer than it really was, giving the attacker a path to convert a bookkeeping error into withdrawable assets.

Attacker Converts Inflated CACAO Into Bitcoin and Other Assets

After the false CACAO balance was recorded, the attacker deposited a tiny amount into the distorted pool and ended up controlling more than 99% of it. That position allowed the attacker to withdraw 48.87 million CACAO and begin swapping those tokens for bitcoin, ether and other assets held in MAYAChain’s pools.

On-chain records show 20.83 BTC, worth about $1.34 million, was sent to the attacker’s bitcoin address. The technical reconstruction also confirmed that assets moved onto outside blockchains at about $1.36 million, while another 8.87 million CACAO remained in the attacker’s MAYAChain wallet. Maya Protocol’s founder said the exploit involved 20 BTC worth about $1.4 million plus roughly $300,000 of other assets.

The figures create an important difference between what the attacker directly took and what the pools ultimately lost in value. The attacker’s extraction was estimated at about $1.65 million including tokens still held on-chain. The liquidity pools, however, experienced a much larger decline because the exploit destabilized CACAO’s price and created conditions for arbitrage across MAYAChain markets.

CACAO Collapse Expands the Damage

CACAO’s sharp drop was central to the broader losses. As the attacker sold into the network, the token’s price fell from around $0.115 to as low as $0.013, before recovering to around $0.03. For a protocol that uses CACAO as a common asset across pools, that price shock did not remain isolated to a single trading pair.

As CACAO became suddenly cheap within the network, arbitrage traders were able to buy the discounted token and exchange it for bitcoin, ether, stablecoins and other assets in MAYAChain’s pools. Arbitrage is a normal part of decentralized markets because traders help realign prices across venues. During a dislocation caused by an exploit, however, arbitrage can deepen the immediate drain on affected pools by converting mispriced assets into more stable or more liquid ones.

The estimated pool-value decline reached about $10.9 million. Of that, roughly $6.4 million reflected CACAO becoming less valuable, while another $2.9 million was linked to traders arbitraging the price dislocation. Those figures show why the total decline in pool value should not be treated as the amount stolen by the attacker. The direct exploit, the token selloff and the market response were related but distinct components of the event.

Why Cross-Chain Liquidity Protocols Face Unique Risks

MAYAChain is designed to let users swap crypto assets across chains without first sending them through a centralized exchange. That model appeals to traders who want direct access to liquidity while retaining decentralized settlement features. It also places heavy pressure on protocol accounting, reserve management and outgoing transaction logic because the system must accurately track value across multiple assets and chains.

When cross-chain infrastructure works properly, liquidity pools can make markets available for assets that do not naturally live on the same blockchain. Users deposit crypto into pools, traders swap against those pools, and the protocol uses its common asset to connect markets. When internal accounting breaks, the effect can cascade rapidly because a balance error in one pool can affect prices and withdrawals in other pools.

The MAYAChain exploit highlights the operational challenge facing smaller cross-chain trading networks. Liquidity providers are not only exposed to regular market risk; they are also exposed to smart-contract and protocol-logic risk. Even when an exploit starts as a bookkeeping issue rather than a direct private-key compromise, the result can still be a drain of real assets once inflated balances are swapped into external chains.

Maya Protocol Seeks Recovery Path

Maya Protocol stopped all trading to contain the damage and said it is working on a fix before swaps resume. The team also said it hopes the attacker will return funds in exchange for a bug bounty. If the funds are not returned, Maya Protocol said it would work on replacing roughly 20 BTC through investments in Aztec Chain and other means.

Repairing the software is only part of the challenge. Much of the CACAO created through the exploit was swapped into other MAYAChain markets and became mixed with tokens belonging to ordinary liquidity providers. That makes restoration more complex than simply patching the bug and restarting the network. The protocol must also address pool imbalances, user confidence and the economic aftermath of the CACAO selloff.

For market participants, the incident is another reminder that decentralized liquidity systems depend on both code correctness and economic resilience. A protocol can suffer losses not only from the assets an attacker directly removes, but also from the market reaction that follows when the common asset connecting its pools collapses. In this case, the distinction between the attacker’s direct haul and the broader pool-value decline is essential to understanding the scale and mechanics of the damage.

Frequently Asked Questions (FAQs)

What happened to Maya Protocol?

Maya Protocol halted MAYAChain after an attacker used a sequence of six software bugs to create a false balance in a liquidity pool and drain bitcoin and other assets from the network.

How much did the attacker take?

The attacker personally extracted about $1.65 million including tokens still held on-chain, while Maya Protocol’s founder described the exploit as involving 20 BTC worth about $1.4 million plus roughly $300,000 of other assets.

Why was the broader pool impact larger?

The broader liquidity-pool value decline was estimated at about $10.9 million because CACAO’s price collapse and arbitrage activity added to the damage beyond the assets taken directly by the attacker.

What role did CACAO play in the exploit?

CACAO is the common asset connecting markets in the Maya ecosystem. The exploit caused a pool to be credited with roughly 49 million CACAO that was not properly funded, allowing the attacker to withdraw inflated value and swap it for other assets.

How far did CACAO fall?

CACAO traded around $0.115 before the exploit, fell as low as $0.013, a drop of nearly 89%, and later recovered to around $0.03.

What happened to the bitcoin involved?

On-chain records show 20.83 BTC worth about $1.34 million was sent to the attacker’s bitcoin address, while the broader exploit also involved other assets and CACAO remaining in the attacker’s MAYAChain wallet.

Did all losses represent stolen funds?

No. The estimated $10.9 million decline in pool value includes the attacker’s extraction, the fall in CACAO’s value, and arbitrage activity. The direct amount attributed to the attacker was much smaller than the total pool-value decline.

What is Maya Protocol doing now?

Maya Protocol halted trading to contain the incident, is working on a fix before swaps resume, and has said it hopes the attacker returns the funds in exchange for a bug bounty.

Can the pools be restored just by fixing the code?

Not fully. Repairing the software does not automatically restore pool value because exploit-created CACAO was swapped through other MAYAChain markets and became mixed with tokens belonging to liquidity providers.

Photo by Leeloo The First on Pexels