Maya Protocol exploit drains bitcoin and other assets as pool value drops $11 million

Cross-chain liquidity protocol Maya Protocol halted its MAYAChain network after a series of software bugs created a false balance in one of its liquidity pools, allowing an attacker to drain nearly $1.7 million in bitcoin $BTC$64,177.56, and other assets, and created a further fallout that caused roughly $11 million in total losses.

Founder @AaluxxMyth said on X exploited for 20 $BTC, worth about $1.4 million, plus roughly $300,000 of other assets. It stopped all trading to contain the damage and said it is working on a fix before swaps resume.

MAYAChain is a smaller cross-chain trading network that lets users swap assets such as bitcoin and ether without first sending them through a centralized exchange, and is part of the broader Maya ecosystem. Traders swap against pools of crypto deposited into the network, with its CACAO token used as the common asset connecting those markets.

A technical reconstruction of then attack identified six bugs that had to work together. The chain began when MAYAChain mistakenly decided that an outgoing transaction had gone missing and triggered code meant to compensate a liquidity pool, or a pile of crypto used to facilitate trades, after a theft.

But that safety mechanism calculated the compensation incorrectly. It added roughly 49 million CACAO to a small pool even though MAYAChain's reserve held only about 168,000 CACAO and could not fund the payment.

The transfer failed, but another bug meant the new balance had already been saved in the network's records. And instead of reversing the change when the payment failed, MAYAChain continued operating as though the pool really contained the extra tokens.

The attacker then deposited a tiny amount into the distorted pool and ended up owning more than 99% of it. They immediately withdrew 48.87 million CACAO and began swapping those tokens for bitcoin, ether and other assets sitting in MAYAChain's pools.

On-chain records show 20.83 $BTC worth about $1.34 million was sent to the attacker's bitcoin address. The analysis confirmed assets moved onto outside blockchains at about $1.36 million, while another 8.87 million CACAO remained in the attacker's MAYAChain wallet.

CACAO collapsed as the attacker sold into the network. The token traded around $0.115 before the exploit and fell as low as $0.013, a drop of nearly 89%, before recovering to around $0.03.

The drop caused damage beyond the assets taken directly by the attacker.

As CACAO plunged, arbitrage traders bought the suddenly cheap token and exchanged it for bitcoin, ether, stablecoins and other assets in MAYAChain's pools.