Maya Protocol Hit by MAYAChain Pool Exploit, Triggering $10.9M Pool Value Drop

Maya Protocol, a cross-chain liquidity protocol, has suffered a security incident that prompted the MAYAChain network to halt trading, Huoxing Finance reported on Aug. 19. Investigators say the attacker chained six software vulnerabilities to tamper with the network's accounting system, artificially boosting a pool's CACAO balance by roughly 49 million tokens even though the pool held only about 168,000 CACAO in reserves. After making a small deposit, the attacker captured more than 99% of the pool's share, then withdrew about 48.87 million CACAO and swapped the proceeds into assets including BTC and ETH. On-chain data shows transfers totaling about 20.83 BTC (roughly $1.34 million) plus other assets, implying direct profits of around $1.65 million. About 8.87 million CACAO remains in the attacker's wallet. The incident drove the combined value of MAYAChain pools down by about $10.9 million. Analysts noted the decline was not solely attributable to stolen funds: roughly $6.4 million was tied to a steep CACAO price drop, while about $2.9 million reflected arbitrage-driven capital outflows. CACAO fell from around $0.115 to as low as $0.013, a drop of nearly 89%, before rebounding to roughly $0.03. Maya Protocol's founder said the team has paused all transactions to limit further losses, is working to patch the vulnerabilities, and is asking the attacker to return the funds under a bug bounty arrangement. If recovery efforts fail, the team plans to offset the roughly 20 BTC shortfall by investing in projects such as Aztec Chain.