Maya Protocol Hacked for $1.7M as CACAO Crashes 89% and Trading Is Halted
Share
Key Takeaways
Maya Protocol suffered an estimated $1.7 million exploit, with the attacker ultimately extracting around 20 BTC and roughly $300,000 in other assets.
CertiK said the attacker manipulated ARB.LINK accounting with a false subsidy, then used liquidity operations to obtain 48.87 million CACAO and 98.82 LINK.
CACAO collapsed from roughly $0.115 to $0.013, an 88.7% decline, while Maya halted swaps and began exploring a bug bounty and recovery plan.
Maya Protocol has halted trading after an attacker manipulated its internal accounting system and extracted roughly $1.7 million in Bitcoin and other assets, sending CACAO down almost 89%.
Maya, co-founder of Aalux, said the protocol appeared to have lost around 20 BTC, worth approximately $1.4 million, plus another $300,000 in other assets. The team initiated a global halt shortly after identifying the exploit to prevent further damage and began working on a patch before swaps could resume.
No reserve was touched. The attacker got the protocol to credit a phantom balance that was never backed by real assets, then cashed part of it out as BTC & ETH.
The attack was more complicated than a straightforward theft from a wallet or reserve.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
Blockchain security firm CertiK said the attacker inflated ARB.LINK accounting using a false subsidy, before adding and removing liquidity to extract approximately 48.87 million CACAO and 98.82 LINK.
The important detail is that the attacker did not simply withdraw assets sitting in a reserve.
MAYAChain suffered a chained six-bug exploit that allowed the attacker to manipulate pool accounting. | Source: @CertiKAlert on X
Instead, the exploit caused MAYAChain to recognize value that had never actually been deposited. Reporting on the incident indicates that one transaction contained 23 messages and exploited several interacting bugs affecting deposits, outbound transactions, and state management.
Once the protocol recorded the false balance, the attacker supplied a small amount of liquidity to the distorted pool, gained control over almost all of the resulting pool position, and withdrew roughly 48.87 million CACAO.
That CACAO could then be exchanged for real BTC, ETH, and other assets held elsewhere in Maya’s liquidity pools.
On-chain analysis cited in reports indicates that about 20.83 BTC, worth roughly $1.36 million at the time, was sent to the attacker’s Bitcoin address. Additional assets and CACAO positions brought the attacker’s estimated haul closer to $1.7 million.
Why CACAO Crashed 89%
CACAO plays a central role inside MAYAChain because assets in its liquidity pools are paired against the token. Maya describes CACAO as the network’s settlement and bridge asset, with a maximum supply of 100 million tokens.
That structure amplified the damage.
As the attacker converted the newly extracted CACAO into real assets, the token fell from about $0.115 to as low as $0.013, an 88.7% collapse within roughly 237 blocks.
The wider decline in Maya’s pool value was much larger than the amount the hacker actually withdrew. Estimates put the overall hit at near $10.9 million, but much of that came from CACAO’s price collapse, slippage, and arbitrage rather than from funds directly stolen by the attacker.
Maya Offers Hacker a Way Out
Aalux said Maya is attempting to contact the attacker and is open to a bug bounty arrangement if the stolen funds are returned.
He also said the team was exploring ways to restore the roughly $1.4 million in lost Bitcoin through investments linked to Aztec Chain and other recovery measures. If the 20 BTC were returned to the pools, Aalux argued that CACAO could potentially recover to its pre-exploit level of around $0.115, although that outcome is far from guaranteed.
For now, swaps remain halted while developers investigate the chain of bugs and prepare fixes. The incident shows how a bookkeeping error can become a real liquidity drain even when an attacker never directly compromises the protocol’s underlying reserves.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
