MAYAChain Hit by Exploit; 20.83 BTC and 48.87M CACAO Drained

MAYAChain, a Cosmos-based decentralized cross-chain trading protocol similar to THORChain, appears to have suffered an exploit, according to a post by founder AaluxxMyth on Aug. 19 (UTC+8). The attacker withdrew roughly 20 BTC (about $1.4 million) plus additional assets worth around $300,000 within the past hour. The team has initiated a global pause, says losses are currently contained, and is working to patch the vulnerability and restore trading. AaluxxMyth said the exploit involved six chain-level vulnerabilities across MAYAChain's Trade Account and outbound processing flow. The attacker crafted a single MsgDeposit transaction containing 23 messages, triggering a faulty "theft detection" mechanism. The attacker then funneled large amounts of CACAO into low-liquidity pools through an unrestricted penalty-subsidy mechanism, followed by liquidity adds and withdrawals to extract funds. About 48.87 million CACAO was drained from the Asgard module. The attacker moved 20.83 BTC to Bitcoin address bc1q0hsgwu...y5l646 and is said to still hold around 8.87 million CACAO. After the incident, CACAO fell from around $0.115 to as low as $0.013, a drop of roughly 88.7%, before rebounding partially. AaluxxMyth said the team will attempt to recover the stolen funds, coordinate with arbitrageurs, and explore additional measures to restore lost liquidity. He added that if the 20 BTC can be reintroduced into liquidity pools, CACAO could rebound to about $0.115. The team continues to investigate and will provide further updates. Source: BlockBeats.