MAYAChain Halts Network Following $1.7 Million Exploit

cryptonews.ruPublicado em 2026-08-19Última atualização em 2026-08-19

Resumo

Maya Protocol, a cross-chain decentralized exchange (DEX), has halted its network after an attacker exploited a series of software vulnerabilities, making off with approximately $1.7 million in crypto assets. According to pseudonymous co-founder Aalux, the attacker stole roughly 20 Bitcoins worth $1.4 million and an additional $300,000 in other assets. The protocol has been fully paused to prevent further damage while vulnerabilities are addressed. A preliminary technical analysis links the incident to six interrelated bugs in trading accounts, outbound transaction processing, and pool liquidity calculations. The attacker allegedly used a single transaction with 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool, and withdraw 48.87 million CACAO tokens from the Maya Asgard module. Approximately $1.36 million of the stolen funds were transferred to external blockchains, with another $291,000 in CACAO and trading positions remaining on MAYAChain. During the incident, the CACAO token price plummeted 88.7% from around $0.115 to $0.013. While the total value across protocol pools dropped by $10.9 million, this figure includes arbitrage activity and token devaluation, not solely the assets directly stolen by the attacker.

The cross-chain decentralized exchange (DEX) Maya Protocol has halted its network after an attacker exploited a series of software vulnerabilities and made off with approximately $1.7 million worth of crypto assets.

On Wednesday, pseudonymous Maya Protocol co-founder Aalux reported that the attacker stole about 20 Bitcoin worth $1.4 million and an additional $300,000 in other assets. He stated that the protocol completely halted the network, prevented further damage, and began patching the vulnerabilities to resume swaps.

A preliminary technical analysis published by Aalux links the incident to six interconnected bugs in trading accounts, outbound transaction processing, and pool liquidity calculations. According to the analysis, the attacker used a single transaction with 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool's volume, and withdraw 48.87 million CACAO tokens from the Maya Asgard module.

The report says about $1.36 million was transferred by the attacker to external blockchains. A further approximately $291,000 in CACAO and trading positions on MAYAChain remained with the attacker.

Independent blockchain security researcher Vini Barbosa summarized the outcome, noting that CACAO dropped 88.7% during the incident—from around $0.115 to $0.013.

According to the analysis, the total value locked (TVL) in the pools decreased by $10.9 million. However, this figure includes arbitrage activity and CACAO depreciation, not just the assets stolen by the attacker.

Related Material: BitBox Fixed 'Serious' Wallet Vulnerabilities That Could Have Put Funds at Risk

end-content

Perguntas relacionadas

QWhat action did the cross-chain decentralized exchange Maya Protocol take after the exploit?

AMaya Protocol halted its network to prevent further damage and began fixing the vulnerabilities before resuming swaps.

QAccording to the co-founder Aalux, what was the approximate value of Bitcoin stolen in the exploit?

AApproximately 20 Bitcoins, worth about $1.4 million, were stolen in the exploit.

QWhat was the primary method used by the attacker in the exploit, as detailed in the preliminary analysis?

AThe attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially increase the volume of a low-liquidity pool, and withdraw 48.87 million CACAO tokens from the Maya Asgard module.

QHow much did the CACAO token price fall during the incident according to independent security researcher Vini Barbosa?

AThe CACAO token price fell by approximately 88.7%, dropping from around $0.115 to $0.013.

QWhat is the total estimated loss in pool value from the incident, and what does this figure include beyond the stolen assets?

AThe total estimated loss in pool value is $10.9 million. This figure includes arbitrage activity and the depreciation of CACAO, not just the assets stolen by the attacker.

Leituras Relacionadas

RWA Tokenization Enters the Next Phase: What is the Truly Time-Consuming Advantage to Build?

The article argues that as tokenization frameworks for Real-World Assets (RWA) mature, the ability to issue assets is becoming less of a competitive advantage. The focus is shifting to what happens *after* issuance: which RWA operations can build enduring trust, maintain stable operations, and remain integrated into the financial ecosystem over the long term. The piece introduces the concept of a **Reserve Layer**—infrastructure that connects tokenized assets to the necessary verification, liquidity, and operational systems for on-chain finance. For an asset to serve as a reliable reserve (e.g., short-term U.S. Treasuries, gold), it needs predictable value, standardized features, deep markets, and observable pricing. However, the true, hard-to-replicate advantage lies not just in the underlying asset but in the **operational track record** built over time. This includes consistent reserve management, independent audits, successful redemptions, maintained liquidity, and protocol integrations. Each successful operation adds evidence, creating a reinforcing cycle: more evidence builds stronger institutional confidence, leading to wider distribution, deeper liquidity, and more use cases as collateral. The article presents a framework combining two dimensions: an asset's suitability as a reserve and the issuer's operational capability. The most sustainable model combines **high-quality reserve assets with strong, long-term operational discipline**. A critical blind spot is an asset with high reserve suitability (like gold) issued by an entity with a limited operational track record; the quality of the infrastructure is separate from the quality of the asset itself. In conclusion, the next phase of RWA will be defined by participants who can pair appropriate reserve assets with the operational rigor to support them through market cycles, thereby transforming tokenized RWAs into durable financial infrastructure.

marsbitHá 32m

RWA Tokenization Enters the Next Phase: What is the Truly Time-Consuming Advantage to Build?

marsbitHá 32m

Trading

Spot
活动图片