Maya Protocol loses about $11 million after MAYAChain attack

Traders Union
All News
Crypto
Maya Protocol loses $11 million

Attack stemmed from six bugs

MAYAChain is a network that enables swaps between assets on different blockchains without using a centralized exchange. Liquidity for these transactions is provided through dedicated pools, while CACAO serves as the common asset connecting the markets.

According to a technical analysis of the incident, the attack resulted from a combination of six software bugs. The network first incorrectly identified an outgoing transaction as lost and triggered a mechanism designed to compensate a liquidity pool.

The system miscalculated the compensation and credited the pool with about 49 million CACAO, even though MAYAChain’s reserve held only around 168,000 tokens. The actual transfer therefore failed, but another bug meant the new balance had already been recorded in the network state and was not reversed.

The attacker deposited a small amount into the distorted pool and obtained more than 99% of its share. They then withdrew 48.87 million CACAO and began swapping the tokens for Bitcoin, Ethereum and other real assets held in MAYAChain’s pools.

On-chain data shows that 20.83 BTC worth about $1.34 million was transferred to an external address controlled by the attacker. Another 8.87 million CACAO remained in the attacker’s MAYAChain wallet after the exploit.

CACAO plunges nearly 90%

The mass sale of the newly obtained tokens sent CACAO down from about $0.115 to $0.013, a decline of nearly 89%. The price later partially recovered to around $0.03.

The collapse triggered arbitrage activity, with traders buying the heavily discounted token and exchanging it for Bitcoin, Ethereum, stablecoins and other assets held in the pools. As a result, the decline in pool value significantly exceeded the amount directly extracted by the attacker.

According to the technical analysis, the attacker obtained about $1.65 million, including tokens that remained in their possession. The total value of the pools fell by roughly $10.9 million, with about $6.4 million attributed to CACAO’s depreciation and another $2.9 million to the effects of arbitrage trading.

MAYAChain offered the attacker a bug bounty in exchange for returning the assets. If the funds cannot be recovered, the team plans to replace roughly 20 BTC through investments in Aztec Chain and other sources.

The incident comes amid a broader debate over the role of artificial intelligence in cybersecurity. More than 30 crypto companies recently urged leading AI developers to give security researchers early access to their most powerful models to help identify vulnerabilities.

Crypto projects lost about $110 million to hacks in July. According to Immunefi, the number of confirmed vulnerability reports that earned researchers rewards also increased during the month.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.