- Maya Protocol halted its network after an estimated $1.7 million theft.
- A preliminary analysis linked the attack to six chained bugs.
- CACAO fell 88.7% during the incident.
The Maya exploit forced the cross-chain decentralized exchange to halt network activity after an attacker used a chain of software flaws to obtain an estimated $1.7 million in crypto. Maya Protocol co-founder Aalux said the attacker stole about 20 Bitcoin worth $1.4 million and another $300,000 in other assets. The team said the pause was intended to stop further damage while engineers worked on a fix to resume swaps. Preliminary analysis also suggested the damage spread beyond the direct theft, with MAYAChain liquidity pools estimated to have lost about $10.9 million when arbitrage effects and CACAO’s sharp price drop were included.
Maya exploit halts network operations
Maya Protocol said it stopped the network after the attack was detected, with Aalux describing the halt as a protective measure. The team said work had already started on a fix so swaps could restart. The response showed the protocol was trying to contain the incident before additional assets could be affected. The project operates as a cross-chain network built from THORChain’s open-source code and is designed to complement it. In the immediate aftermath, the Maya exploit became more than a theft story because the shutdown interrupted normal protocol activity and raised concerns about the health of associated liquidity pools.
Maya exploit mechanics in preliminary analysis
A preliminary technical analysis shared by Aalux said the Maya exploit relied on six chained bugs. Those bugs involved trade accounts, outbound transaction handling and liquidity pool calculations. The review said a 23-message transaction was used to trigger the sequence. According to the analysis, the transaction overwrote records used to track outbound transfers. That caused transfers to be marked as missing and activated a theft-protection mechanism. The same mechanism then miscalculated compensation for Maya’s low-liquidity Arbitrum Chainlink pool, identified as ARB.LINK, and incorrectly credited that pool with 49.45 million CACAO.
Pool losses and CACAO fallout
The analysis said the transfer meant to fund that credit failed because Maya’s reserve did not hold enough CACAO. Even so, the inflated pool balance stayed in place. That accounting distortion then gave the attacker an opening to exploit the pool despite the missing backing for the credited amount. The attacker then added negligible liquidity, obtained 99.93% of the pool and withdrew 48.87 million CACAO from Asgard, which holds protocol assets. Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO dropped 88.7% during the incident, falling from about $0.115 to $0.013. While the direct theft was estimated at $1.7 million, the preliminary review said wider losses across MAYAChain pools reached about $10.9 million after arbitrage and the token collapse were considered.
Conclusion
The Maya exploit led Maya Protocol to halt its network after an estimated $1.7 million theft tied to six chained bugs and a 23-message transaction. Preliminary findings said the attack disrupted outbound transfer records, triggered a flawed compensation process and left an inflated ARB.LINK pool balance that the attacker later used to withdraw 48.87 million CACAO from Asgard. Beyond the direct theft, the incident hit MAYAChain’s liquidity pools hard, with estimated losses of about $10.9 million once arbitrage and CACAO’s 88.7% price drop were included. Maya Protocol has said it is working on a fix, seeking fund recovery through a bug bounty and trying to restore liquidity.
Disclaimer
The information provided in this article is for informational purposes only and should not be considered financial advice. The article does not offer sufficient information to make investment decisions, nor does it constitute an offer, recommendation, or solicitation to buy or sell any financial instrument. The content is opinion of the author and does not reflect any view or suggestion or any kind of advise from CryptoNewsBytes.com. The author declares he does not hold any of the above mentioned tokens or received any incentive from any company.
Featured image created by AI
