preferred on
Points of Focus
- Maya Protocol halted its cross-chain network after an estimated $1.7-million exploit.
- The attacker chained six vulnerabilities through one transaction.
- Around $1.4 million was transferred to external blockchains.
Maya Protocol has suspended its cross-chain network after an attacker exploited six interconnected software flaws and extracted an estimated $1.7 million in Bitcoin (BTC) and other digital assets.
The protocol activated a global halt to prevent further losses while developers investigated the incident and prepared fixes. Maya Protocol has not announced when cross-chain swaps will resume.
Pseudonymous co-founder Aalux said the attacker obtained about 20 BTC, valued at $1.4 million, alongside another $300,000 in crypto assets.
Attacker chained six vulnerabilities
Preliminary technical findings indicate that the attacker combined six bugs affecting trade accounts, outbound transaction processing and liquidity pool calculations.
Rather than exploiting a single weakness, the attacker executed the entire sequence through one transaction containing 23 messages. The transaction allegedly triggered Maya Protocol’s theft-detection mechanism incorrectly before manipulating a pool with limited liquidity.
We have seen a ~$1.7M exploit on @Maya_Protocol.
The attacker inflated https://t.co/1bbf3CvbFn accounting with a false subsidy, then add/remove liquidity
to extract ~48.87M CACAO and 98.82 LINK from shared liquidity.Stay Vigilant!https://t.co/x0tRILJf0i pic.twitter.com/Hqk0Sowj9x
— CertiK Alert (@CertiKAlert) August 19, 2026
By artificially inflating the value of that pool, the attacker reportedly withdrew 48.87 million CACAO tokens from Maya’s Asgard module. Asgard modules hold assets used to process swaps between blockchains, making their accounting and security critical to Maya Protocol’s operations.
Initial estimates show that about $1.36 million was transferred to external blockchains.
Another $291,000 remained under the attacker’s control through CACAO holdings and trade-account positions on MAYAChain.
CACAO collapses as liquidity drains
CACAO, the protocol’s native token, fell by 89% during the incident, dropping from $0.115 to $0.013, according to blockchain security researcher Vini Barbosa.
The crash complicated estimates of the total damage. Preliminary analysis placed the decline in pool value at about $10.9 million.
🚨Maya Protocol’s MAYAChain was reportedly hit by a sophisticated six-bug exploit, with roughly $1.36M in hard assets extracted.$CACAO reportedly crashed ~89% in under 240 blocks.
Another reminder that in #DeFi , one vulnerability can erase years of work in minutes.
— Antonio Izarazuh (@Antonioizarazuh) August 19, 2026
However, that figure includes arbitrage activity and the sharp depreciation of CACAO rather than only assets stolen by the attacker.
The amount extracted or retained in attacker-controlled positions remains closer to $1.7 million.
Cross-chain security risks grow
Maya Protocol joins several cross-chain platforms forced to suspend operations following security incidents in 2026. THORChain halted trading after approximately $10.7 million was drained from one of its vaults, while Axelar disabled routes linked to Secret Network following a $4.7-million exploit.
Such incidents highlight the risks created by cross-chain systems, which rely on multiple vaults, validators, liquidity pools and transaction-verification components to move assets between separate networks.
Sad news 😕
Will work to fix and recover in full. We carry on. @Maya_Protocol pic.twitter.com/EYK9BeWWLI— Aaluxx⚡️🍫🛡️ (@AaluxxMyth) August 18, 2026
Developers are now working to address the vulnerabilities before restoring swaps. Aalux said the global halt successfully contained the incident and prevented additional losses.
However, recovery will likely require comprehensive testing of the affected accounting, outbound-processing, and theft-detection systems.
Until Maya Protocol releases a technical post-mortem and restart plan, the timeline for resuming full network operations remains unclear.
Share
Most read articles
