MAYAChain halts network after estimated $1.7M exploit
Written by Ezra Reguerrastaff writerReviewed by Yohan Yunstaff editorA preliminary analysis says six chained bugs let a 23-message transaction drain 48.87 million CACAO, sending the token down nearly 89%.
Cross-chain decentralized exchange (DEX) Maya Protocol halted its network after an attacker exploited a series of software flaws to obtain an estimated $1.7 million in crypto.
On Wednesday, Maya Protocol’s pseudonymous co-founder Aalux said the attacker stole about 20 Bitcoin, valued at $1.4 million and another $300,000 in assets. He said the protocol implemented a global halt, contained further damage and started working on a fix to resume swaps.
A preliminary technical analysis shared by Aalux attributed the incident to six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. It said the attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool and withdraw 48.87 million CACAO tokens from Maya’s Asgard module.
The report calculated that about $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on MAYAChain.
Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO fell by 88.7%, from approximately $0.115 to $0.013 during the incident.
The analysis estimated a wider $10.9 million decline in pool value, but said that figure included arbitrage activity and CACAO’s devaluation rather than assets stolen solely by the attacker.
Related: BitBox patches ‘severe’ wallet flaws that could put funds at risk
