Maya Protocol Suspends Cross-Chain Operations After $1.7M Exploit

Maya Protocol has paused its cross-chain network after an exploit that moved about $1.7 million in assets, including Bitcoin and other tokens, CoinMarketCap reported. The protocol said the attacker chained together six software vulnerabilities, executing the theft in a single transaction carrying 23 messages. Initial disclosures indicate roughly $1.36 million has already been bridged out to external blockchains, while about $291,000 remains in positions and wallets under the attacker's control. Co-founder Aalux said the team initiated a system-wide pause to prevent further losses. Early technical findings suggest the incident did not stem from one isolated flaw, but from sequential exploitation across multiple components. The attacker reportedly first spoofed the protocol's theft-detection mechanism, then manipulated a low-liquidity pool. After inflating that pool's valuation, the attacker withdrew 48.87 million CACAO from Maya's Asgard module. Asgard holds the assets used to process cross-chain swaps, and its accounting and settlement functions are central to the protocol's cross-chain operations. Independent blockchain security researcher Vini Barbosa summarized preliminary data showing CACAO fell from about $0.115 to $0.013 during the incident, a drop of 88.7%. Separate technical analysis indicated the affected liquidity pool's total value declined by about $10.9 million, though that figure is not a direct proxy for stolen funds because it also reflects arbitrage activity and asset depreciation as CACAO's price slid. Maya Protocol said it is focused on remediation and has not provided a timeline for resuming cross-chain swaps. The incident adds to a string of cross-chain disruptions this year. In May and June, THORChain and Axelar also temporarily suspended certain functions due to cross-chain vulnerabilities or connectivity risks, underscoring ongoing custody and settlement risks in cross-chain infrastructure.