Cross-chain decentralized exchange Maya Protocol halted its network on August 19, 2026, following a severe security breach. The exploit allowed an attacker to drain digital assets valued at approximately $1.7 million from its liquidity infrastructure.
Sad news 😕
Will work to fix and recover in full. We carry on. @Maya_Protocol pic.twitter.com/EYK9BeWWLI— Aaluxx⚡️🍫🛡️ (@AaluxxMyth) August 18, 2026
The project’s pseudonymous co-founder, Aalux, confirmed that the attacker stole roughly 20 Bitcoin, worth approximately $1.4 million. In addition to the leading cryptocurrency, the intruder extracted another $300,000 in various digital assets from the platform.
The immediate suspension of network activity prevented further capital losses across the protocol’s liquidity reserves. Following the emergency shutdown, core developers began creating and testing a technical patch to safely resume cross-chain swap services.
Technical mechanics and exploit execution
More details: https://t.co/aLab4kZwXE
— Aaluxx⚡️🍫🛡️ (@AaluxxMyth) August 18, 2026
According to a preliminary technical analysis published by Aalux, the incident stemmed from six chained bugs in the codebase. These flaws simultaneously affected trade accounts, outbound transfer processing, and internal balance calculations across liquidity pools.
The exploit was executed through a single transaction containing 23 structured messages. This transaction overwrote outbound transfer records, causing the software to classify previously completed transfers as missing operations within the system.
This false classification triggered an automated theft-protection mechanism within the protocol. The routine miscalculated compensation for the low-liquidity Arbitrum Chainlink (ARB.LINK) pool, mistakenly crediting it with 49.45 million CACAO tokens.
The internal transfer intended to back that credit failed because the protocol reserve held insufficient funds. However, the inflated pool balance remained active in the protocol’s accounting state rather than being reverted by the network.
The attacker leveraged this numerical discrepancy by injecting a negligible amount of liquidity into the pool. This action granted them 99.93% pool ownership, allowing them to withdraw 48.87 million CACAO directly from the Asgard vault.
Protocol architecture and market impact
Maya Protocol operates as a decentralized network derived from THORChain’s open-source architecture. Its infrastructure enables native asset swaps across independent Blockchain networks, utilizing the native CACAO token for gas fees, settlement, and liquidity pool pairing.
The Asgard vault functions as the primary security module holding locked assets provided by liquidity participants. The chained flaws allowed the attacker to interact with this core storage vault without triggering normal withdrawal security constraints.
sad day for @Maya_Protocol (i love the project) 🙁
MAYAChain just suffered a sophisticated 6-bug exploit that extracted ~$1.36M in hard assets to L1 and left the protocol with roughly $11M in total impact$CACAO went from $0.115 → $0.013 (−88.7%) in under 240 blocks
this was… https://t.co/X4hth17BTB
— Vini B 「thecoding.dev」 (@vinibarbosabr) August 18, 2026
Independent blockchain researcher Vini Barbosa confirmed that CACAO plunged 88.7% during the incident. The token’s market price collapsed rapidly from roughly $0.115 down to $0.013 following the massive token extraction.
Technical estimates indicated that liquidity pools experienced a total value loss of $10.9 million. This calculation includes the stolen assets, subsequent arbitrage extraction across connected pools, and the severe devaluation of the CACAO token reserves.
The development team stated they would pursue the recovery of stolen funds by offering a white-hat bug bounty. Meanwhile, engineers are actively working to restore the balance sheet and rebuild overall pool liquidity across the network.
The full resumption of network swaps remains contingent on testing the software patch and achieving validator node consensus. As of publication, the team has not established a final timeline for restarting cross-chain transactions.
This article is for informational purposes only and does not constitute financial advice.
