Six-Bug Exploit Halts Maya Protocol After $1.4 Million in Bitcoin Stolen
Maya Protocol halted its cross-chain liquidity network after an attacker exploited six software flaws and drained about $1.7 million in Bitcoin and other assets. The exploit hit MAYAChain, a decentralized swap network for assets like Bitcoin and Ethereum, and forced the team to pause operations to contain the damage and patch the code before restarting swaps. The attack used a 23-message deposit transaction to trigger a false theft response, inflate a low-liquidity pool’s CACAO balance, gain nearly full control of the pool, and withdraw the inflated value. As the attacker converted tokens into Bitcoin and other assets, CACAO’s price collapsed, limiting the final haul. The team said about $1.65 million was extracted overall, with roughly $1.36 million moved off-chain and about $291,000 left on-chain. The bugs had reportedly gone unnoticed for years despite audits. Maya Protocol published the suspected attacker’s Bitcoin address and said it hopes the funds will be returned for a bug bounty.
