Maya Protocol's unresolved liquidity incident nears $11M as attacker wallet still holds 20.83 BTC

The Bitcoin address believed to be tied to Maya Protocol's Aug. 18 exploit still held about 20.8273 BTC as of Aug. 21, with no outgoing spend recorded on-chain. Public Bitcoin data showed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none pending in the mempool. Ten deposits totaling 20.82730682 BTC landed at 17:32:18 UTC on Aug. 18, followed by a 546-satoshi transfer that lifted the balance marginally. At current prices, the wallet's holdings were valued near $1.59 million. Maya Protocol founder Aaluxx previously said the network likely lost around 20 BTC, worth about $1.4 million at the time, plus roughly $300,000 in other assets, and pledged to work toward a full recovery. No public recovery plan has since outlined how the protocol will address the broader estimated damage across its crosschain liquidity pools. A technical reconstruction by SigIntZero attributed the incident to six accounting and state-handling flaws chained into a single 23-message transaction. The analysis said overwritten outbound state created a false "missing transfer" signal that triggered a compensation path, crediting about 49.45 million CACAO to a lightly capitalized ARB.LINK pool despite Maya's reserve holding only about 168,000 CACAO. The reserve transfer failed, but the inflated balance remained. After adding minimal liquidity, the attacker allegedly captured about 99.93% of the pool's ownership units, withdrew roughly 48.87 million CACAO, and swapped into assets held by other MAYAChain pools. SigIntZero estimated roughly $1.36 million in assets moved to external chains while about $291,000 remained on MAYAChain, putting attacker-controlled value around $1.65 million to $1.7 million. Beyond the direct outflows, the pools also suffered an estimated $10.9 million impact. A CryptoSlate analysis attributed about $6.4 million of that to CACAO repricing and about $2.9 million to arbitrage after CACAO fell from roughly $0.115 to $0.013, an 88.7% drop. Maya is reportedly hoping for a bug-bounty-style return of funds and, if that fails, may attempt to replace around 20 BTC via Aztec Chain investments and other avenues. Even if the Bitcoin is returned or replaced, it would address only part of the damage. As of publication, Maya had not specified which remaining losses it plans to make whole, or how it will allocate the gap tied to CACAO's repricing and trading during the dislocation.