Image Credit: Shutterstock
Maya Protocol has halted trading on MAYAChain after an attacker chained six software flaws to extract an estimated $1.7 million in crypto assets. Pseudonymous co-founder Aalux said the attacker took about 20 BTC, worth roughly $1.4 million, plus around $300,000 in other assets.
Maya said the global halt contained further damage while developers began preparing fixes. Cross-chain swaps remain unavailable, and the protocol has not announced when trading will resume.
Six Bugs Combined Inside One 23-Message Transaction
A preliminary technical reconstruction traced the exploit to six interacting flaws involving trade accounts, outbound transaction processing and liquidity-pool calculations. The attacker combined them inside a single transaction containing 23 messages.
The sequence triggered a false theft alert and faulty compensation logic that credited a low-liquidity pool with roughly 49 million CACAO that had not been properly funded. Another bug allowed the incorrect balance to remain in MAYAChain’s records.
The attacker then gained control of most of the distorted pool and withdrew 48.87 million CACAO from Maya’s Asgard module before swapping tokens into Bitcoin and other assets.
$1.36M Reached External Chains as CACAO Fell 88.7%
The analysis estimates that about $1.36 million reached external blockchains. Another roughly $291,000 remained under the attacker’s control in CACAO and trade-account positions on MAYAChain.
CACAO fell about 88.7% during the incident, dropping from roughly $0.115 to $0.013 before partially recovering.
The wider decline in Maya’s liquidity pools was estimated at about $10.9 million. That figure is not the amount stolen: the analysis attributed much of the additional damage to CACAO’s falling value and arbitrage around the resulting price dislocation.
Maya Prepares Six Fixes Before Cross-Chain Swaps Resume
Maya is working through the identified vulnerabilities before restoring trading. Aalux said the protocol intends to fix the flaws and recover the losses, while the team has also expressed hope that the attacker could return funds in exchange for a bug bounty.
No recovery mechanism or restart time has been announced. Cross-chain swaps remain halted while Maya completes the fixes and assesses recovery of the affected liquidity.
