TL;DR
- Exploit details: An attacker used six chained bugs to steal $1.7 million and trigger major liquidity issues across MAYAChain.
- Pool manipulation: Miscalculated compensation inflated an ARB.LINK pool, allowing the attacker to gain 99.93% control and withdraw 48.87 million CACAO.
- Market fallout: CACAO crashed 88.7%, deepening losses as MAYAChain halted operations and began working on fixes and a bug bounty recovery plan.
Cross-chain decentralized exchange Maya Protocol halted operations after an attacker exploited multiple software flaws to drain an estimated $1.7 million in crypto. The incident unfolded quickly, prompting the team to freeze activity across MAYAChain to prevent further losses and begin working on a fix. Co-founder Aalux said the attacker stole roughly 20 Bitcoin worth $1.4 million, along with another $300,000 in assets, before the halt took effect.
Sad news 😕
Will work to fix and recover in full. We carry on. @Maya_Protocol pic.twitter.com/EYK9BeWWLI— Aaluxx⚡️🍫🛡️ (@AaluxxMyth) August 18, 2026
Technical breakdown of the exploit
Aalux shared a preliminary analysis outlining six chained bugs that allowed the attacker to manipulate trade accounts, outbound transaction handling, and liquidity pool calculations. According to the findings, the transaction at the center of the exploit overwrote records tracking outbound transfers. This caused transfers to be flagged as missing, which activated a theft-protection mechanism. That mechanism miscalculated compensation for the low-liquidity Arbitrum Chainlink pool and incorrectly credited it with 49.45 million CACAO.
The transfer meant to fund that credit failed because the reserve lacked sufficient CACAO, but the inflated pool balance remained. With MAYAChain still active at that moment, the attacker added negligible liquidity, gained control of 99.93% of the pool, and withdrew 48.87 million CACAO from Asgard, the vault that holds protocol assets. The analysis estimated that MAYAChain’s pools lost about $10.9 million in value, including losses tied to arbitrage and CACAO’s collapse.
Market impact and next steps
Maya Protocol, built from THORChain’s open-source code, is designed to complement its architecture. CACAO, the gas and settlement token for MAYAChain, is paired with supported assets in its liquidity pools. Independent researcher Vini Barbosa summarized the findings and noted that CACAO fell by 88.7%, dropping from approximately $0.115 to $0.013 during the incident. The sharp decline added pressure to MAYAChain’s ecosystem as liquidity evaporated.
Aalux said the team will seek the return of stolen funds through a bug bounty and work to restore liquidity once MAYAChain resumes swaps. The halt remains in place while engineers continue assessing the damage and preparing recovery steps for the network.
