Maya Protocol had run for more than three years since its April 2023 mainnet launch with no documented loss-of-funds incident. On August 18 an attacker sent a single transaction containing 23
Maya Protocol had run for more than three years since its April 2023 mainnet launch with no documented loss-of-funds incident.
On August 18 an attacker sent a single transaction containing 23 messages. It triggered six separate flaws in sequence.
The direct theft was roughly $1.7 million. The pools lost around $11 million.
MAYAChain is a cross-chain trading network that lets users swap assets such as bitcoin and ether without routing through a centralized exchange. Its CACAO token is the common asset connecting those markets.
The attack began by causing the network to conclude, wrongly, that an outgoing transaction had gone missing.
That triggered code designed to compensate a liquidity pool after a theft. The compensation was calculated incorrectly, using an uncapped slash subsidy that wildly inflated the CACAO balance of a low-liquidity pool.
The inflated state was saved before the system attempted to fund it. When the funding transfer failed, the error was logged but never rolled back, leaving the inflated balance in place.
The attacker then added minimal liquidity to the inflated pool, instantly gaining 99.93% ownership, and withdrew.
The team’s post-mortem describes the pool being inflated by 49.45 million CACAO, with 48.87 million withdrawn.
Coverage this week has quoted $1.7 million and $11 million interchangeably. They measure different things.
The direct extraction was around $1.65 million to $1.7 million, comprising roughly 20.83 BTC worth about $1.34 million to $1.4 million sent to a single Bitcoin address, plus around $291,000 to $300,000 in other assets including 98.82 LINK.
The $10.9 million to $11 million figure is the drop in total pool value, driven mostly by CACAO’s price collapse rather than by tokens the attacker carried away.
CACAO fell from around $0.115 to roughly $0.013, a decline near 88%, before partially recovering toward $0.03.
That collapse limited what the attacker could extract. It also transferred the loss onto ordinary liquidity providers.
ItemFigurePool inflated by49.45 million CACAOCACAO withdrawn48.87 millionPool ownership gained99.93%Direct theftabout $1.7 millionBitcoin takenabout 20.83 BTC, roughly $1.34 millionTotal pool value lostabout $11 millionCACAO price declineabout 88%Bugs chained6, via one 23-message transaction
This is the part with implications beyond Maya.
No single bug here was necessarily catastrophic. The exploit required six flaws across trade-account handling, outbound transaction processing and liquidity-pool mathematics to interact in a precise order.
Audits typically examine components. A vulnerability that only exists in the composition of six correct-looking behaviors is a much harder target.
Optimisus covered a structurally similar failure earlier this month, when an attacker minted 4 billion Harmony tokens and the supply endpoint did not reflect it. In both cases the accounting layer and the reporting layer failed together.
Supply chain compromises produce the same outcome by a different route, as with the 1inch dependency attack.
MAYAChain triggered its Mimir emergency halt, suspending deposits and withdrawals on affected pools.
Fixing the software does not restore the pools. Much of the CACAO created through the exploit was swapped into other MAYAChain markets and is now mixed with tokens belonging to ordinary liquidity providers.
Independent arbitrage traders also extracted value from the price dislocation. That was a downstream market reaction rather than part of the original exploit, but it deepened the hole.
The team has said it is exploring recovery options including a white-hat bounty offer to the attacker.
THORChain faced a comparable situation in May, when a node operator exploited a threshold signature vulnerability. Reported losses were initially $10.8 million and later adjusted to $7.4 million. Node operators approved a recovery plan using protocol-owned liquidity to absorb the loss without minting or selling RUNE.
That precedent is the most likely template, and it depends on having protocol-owned liquidity available to absorb the gap.
Cross-chain liquidity networks keep appearing in this column for a structural reason.
They maintain internal accounting across multiple chains with different finality assumptions, and they hold real assets against internal balances. When the accounting desynchronizes from reality, the internal ledger can be inflated while the assets behind it are not.
One security tracker logged the Maya incident as the sixteenth crypto hack recorded in August alone.
The AI dimension is worth a brief note. The complexity of the chained exploit prompted speculation about automated vulnerability discovery, but the Maya team did not say whether it believes AI was used. Optimisus covered the capability question in the piece on the offensive security model released to vetted defenders.
That remains speculation. What is documented is a six-flaw chain that a human researcher could plausibly have found.
A clean three-year security record was not predictive here, and it rarely is.
For anyone providing liquidity on a cross-chain protocol, the exposure is not only to a direct theft. It is to the token collapse that follows, which in this case was roughly six times larger than what the attacker took.
A full technical post-mortem is expected from the development team. That document, rather than the headline figures, is where the useful detail will be.
This is not financial advice.
Optimisus covers crypto and technology news for readers who want the detail behind the headlin
