Cross-chain decentralized exchange Maya Protocol halted its network Wednesday after an attacker chained six software flaws into a single exploit, draining an estimated $1.7 million in bitcoin and other assets and sending the protocol's CACAO token down nearly 89%.
Pseudonymous co-founder Aalux said the attacker stole approximately 20 bitcoin — worth about $1.4 million at current prices — plus roughly $300,000 in other assets. The protocol implemented a global halt, contained the damage, and began work on a fix to resume swaps.
Anatomy of the Attack
A preliminary technical analysis shared by Aalux attributes the incident to six chained bugs involving trade accounts, outbound transaction handling, and liquidity pool calculations.
The attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool, and withdraw 48.87 million CACAO tokens from Maya's Asgard module — the protocol's vault system.
The report calculated that about $1.36 million was moved to external blockchains, while roughly $291,000 remained with the attacker in CACAO and trade-account positions on MAYAChain.
Independent security researcher Vini Barbosa, summarizing the findings, noted that CACAO collapsed from approximately $0.115 to $0.013 during the incident — an 88.7% decline.
Pool Damage vs. Stolen Assets
Headline pool-value figures overstate the direct theft. The analysis estimated a wider $10.9 million decline in pool value, but attributed most of that figure to arbitrage activity flooding the distorted pools and the collapse in CACAO's own valuation rather than assets the attacker extracted.
The distinction matters for recovery expectations: the attacker's realized gain appears to be the $1.7 million already moved off-chain, while remaining positions on MAYAChain are frozen under the global halt.
Cross-Chain Risk in Focus
Maya Protocol, a THORChain sibling network for cross-chain swaps, is the latest reminder that cross-chain infrastructure remains the most attacked corner of DeFi. The incident involved no single catastrophic bug — instead, six individually survivable flaws compounded into a systemic failure, a pattern that has repeated across bridge and swap exploits for years.
The network remains halted while the team prepares a fix. Users with open positions on the protocol should follow official Maya channels for the resumption timeline and any remediation plan.