Key Takeaways A sophisticated exploit drained approximately $1.7 million from Maya Protocol, marking the platform’s first significant security breach since its 2023 inception The exploit leve
Maya Protocol, a cross-chain decentralized trading platform, executed an emergency network shutdown on Wednesday following a security breach that resulted in approximately $1.7 million in stolen cryptocurrency.
BREAKING: Maya Protocol EXPLOITED for $1.7 MILLION in a sophisticated 6-bug attack.
MAYAChain suffered a chained six-bug exploit that allowed the attacker to manipulate pool accounting, gain 99.93% ownership of an inflated pool and extract roughly $1.36M in hard assets to L1,… pic.twitter.com/564eODmfld
— Coin Bureau (@coinbureau) August 19, 2026
Aalux, one of the protocol’s co-founders, publicly acknowledged the security incident and disclosed that the development team had initiated a comprehensive network halt to prevent additional losses.
The malicious actor successfully extracted approximately 20 Bitcoin worth roughly $1.4 million, in addition to approximately $300,000 in various other digital assets.
Initial forensic analysis revealed the attack exploited a chain of six interconnected vulnerabilities affecting trade account functionality, outbound transaction processing, and liquidity pool calculation mechanisms.
The perpetrator executed a sophisticated single transaction comprised of 23 individual messages that manipulated the system’s theft detection protocols, artificially inflated a pool with minimal liquidity, and subsequently extracted 48.87 million CACAO tokens from Maya’s Asgard vault module.
Approximately $1.36 million in stolen funds were transferred to external blockchain networks, while the attacker retained around $291,000 worth of CACAO tokens and trade-account holdings within the Maya ecosystem.
Blockchain security analytics firm PeckShield identified the breach and confirmed that assets were extracted from the protocol’s vault infrastructure before the platform’s automated solvency verification systems could prevent the outflow completely.
Prior to the attack, Maya Protocol held approximately $15 million in total value locked, based on data from DeFiLlama. The theft accounted for slightly more than 10% of that total.
CACAO’s circulating market capitalization currently stands at approximately $10 million. The token had already experienced a decline exceeding 92% from its peak price of $1.43 prior to this security incident.
Independent blockchain analyst Vini Barbosa calculated the broader pool value decrease at approximately $10.9 million, though this figure encompasses arbitrage trading activity and token devaluation in addition to the direct theft.
Aalux confirmed that developers have successfully identified the security weakness and are actively working on implementing corrective measures. He expressed appreciation for the rapid coordination from node operators.
As a derivative project of THORChain, Maya Protocol implements a “halt first” security framework, which prioritizes immediate trading suspension for investigation purposes rather than pursuing emergency bailout procedures.
The protocol’s Mimir emergency halt mechanisms were triggered, suspending all deposit and withdrawal operations for compromised liquidity pools while validators and technical teams conduct their investigation.
This security breach comes after THORChain experienced its own exploit in May 2026, initially reported as $10.8 million but subsequently adjusted to $7.4 million, which similarly necessitated a complete trading suspension.
Maya had maintained a clean security record for over three years following its mainnet deployment in April 2023, with no documented loss-of-funds incidents until now.
A comprehensive technical post-mortem analysis explaining how the attacker circumvented Maya’s security architecture is anticipated from the development team within the next several days.
The post Maya Protocol Loses $1.7 Million in Sophisticated Multi-Bug Exploit appeared first on Blockonomi.
