Six bugs, three years, one 23-message heist: MAYAChain's $1.7M oops

Maya Protocol halted its cross-chain network on Tuesday after an attacker exploited a chain of six software flaws to extract roughly $1.7 million in cryptocurrency, including about 20 Bitcoin. The team said the network pause was intended to contain the damage and that engineers were working on a patch before resuming swaps.

The exploit targeted MAYAChain, a cross-chain liquidity network built from THORChain's open-source code and operated by Maya Protocol. According to a post-mortem published by the team, pseudonymous co-founder Aalux — also known as AaluxxMyth — disclosed the incident on X, writing, "No way to sugar coat this. We have likely been exploited by 20 BTC ($1.4M) and other assets ($300k)." The team's analysis traced the attack to a single 23-message MsgDeposit transaction that triggered a false "theft" detection and inflated a low-liquidity pool's CACAO balance through an uncapped slash subsidy.

Maya Protocol said the transaction overwrote records tracking outbound transfers, causing transfers to be classified as missing. That activated a theft-protection mechanism that miscalculated compensation for Maya's low-liquidity Arbitrum Chainlink (ARB.LINK) pool and incorrectly credited it with 49.45 million CACAO. The intended funding transfer failed because Maya's reserve held insufficient CACAO, but the inflated pool balance persisted. The attacker then added negligible liquidity, acquired 99.93% of the pool and withdrew 48.87 million CACAO from Asgard, which holds protocol assets. Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO's price fell 88.7%, from approximately $0.115 to $0.013, during the incident.

The team estimated the attacker's total haul at roughly $1.65 million, including about $1.36 million moved to external blockchains and roughly $291,000 remaining on-chain, with the suspected attacker address receiving 20.83 BTC worth about $1.34 million. The broader impact on MAYAChain's liquidity pools was estimated at about $10.9 million in lost value, including arbitrage losses and CACAO's collapse. Aalux said the bugs had gone undetected for three to four years despite audits by Halborn and Fable 5, and wrote that "We have to get even more adversarial and look for extremely simple code primitives… We already knew our job was difficult, but the mission is worth it." The team published the suspected attacker's Bitcoin address and said it would seek the return of stolen funds through a bug bounty.