MAYAChain's mainnet was hit at roughly 17:30 UTC on Aug. 18 when an attacker exploited a chain of six software bugs to extract approximately $1.7 million from shared liquidity pools. The direct theft broke into two parts: 20.83 BTC, worth around $1.34 million, bridged to a single Bitcoin address, and 8.87 million CACAO valued at approximately $288,000 at post-exploit prices.
The attack chained six separate bugs in sequence, each enabling the next. It started with a batched deposit transaction containing enough internal messages to force the system to overwrite accounting records tied to one transaction ID—a collision that corrupted the ledger at the base level.
That overwrite caused the outbound-verification logic to misread where funds had gone. The system misidentified a legitimate transfer as theft, triggering a slashing calculation against a low-liquidity pool. That slashing calculation had no upper bound, so it overstated the pool's CACAO balance.
The inflated balance was written to storage before the system tried to fund it. When the funding transfer failed, the error was logged but the corrupted balance was never reversed. That left a pool showing a grossly overstated CACAO position with no real backing.
The attacker then added a small amount of liquidity to the artificially fattened pool, instantly acquiring near-total ownership at minimal cost. A withdrawal of that ownership position pulled out the inflated value—an accounting manipulation rather than a smart-contract reentrancy or flash loan.
Blockchain security firm CertiK confirmed the assets came from shared liquidity pools and identified the extracted assets as including CACAO and LINK. The remaining CACAO still held on-chain by the attacker represents a potential recovery target; the Maya team noted those funds are positioned to be frozen.
CACAO's token price fell from around $0.115 to roughly $0.013 as the attacker swapped stolen assets into other tokens, an 88 percent collapse. The token partially recovered to the $0.03 range in the hours following the halt. The price dislocation created an arbitrage window that independent traders used to extract additional value from the pools—losses distinct from what the attacker personally drained.
Total pool value declined by an estimated $10.9 million when factoring in both the direct theft and downstream arbitrage-driven losses. That figure puts the protocol-wide damage far above the attacker's personal take of roughly $1.7 million, illustrating how a liquidity-pool exploit in a low-liquidity environment can amplify losses across the entire system through cascading price impact.
The Maya Protocol team halted all network operations immediately after detecting the breach, pausing token swaps across MAYAChain while engineers isolated and patched the six bugs. Founder AaluxxMyth acknowledged the incident and committed to making affected users whole. The team extended a white-hat offer to the attacker: disclose the vulnerability details and return the funds in exchange for a bounty with no legal pursuit.
AaluxxMyth indicated plans to accelerate the protocol's development roadmap following the incident, though no specific timeline or mechanism for the recovery fund was detailed. The open question is whether the on-chain CACAO position can be frozen before the attacker moves it—cross-chain asset recovery is technically possible when funds remain on the native chain but requires validator coordination and swift action given the attacker controls approximately $288,000 in CACAO at depressed prices.
Maya Protocol is a cross-chain liquidity platform operating its own mainnet, MAYAChain, with pools that hold multiple assets simultaneously. The architecture shares conceptual DNA with THORChain's continuous liquidity pool model, where native assets sit in shared vaults rather than wrapped representations. That design enables cross-chain swaps without bridges but concentrates custodial risk in the protocol's own accounting layer—the exact layer the attacker targeted. The six-bug chain required no external oracle manipulation and no flash loan; it exploited the internal bookkeeping of the protocol itself.
