Six software bugs drain $11 million from Maya Protocol

An exploit chaining six separate software bugs struck the Maya Protocol's MAYAChain mainnet at around 17:30 UTC on 18 August, draining assets from its liquidity pools and forcing the network to halt trading. The attack began when MAYAChain wrongly registered an outgoing transaction as lost, triggering a compensation mechanism meant to make a liquidity pool whole after stolen or missing funds. That mechanism instead created roughly 49 million unfunded CACAO tokens.

Maya Protocol founder AaluxxMyth said the attacker extracted 20 BTC, worth roughly $1.4 million, along with about $300,000 in other assets, while the wider fallout left the protocol's liquidity pools around $11 million lighter. Trading and swaps remain halted while the team works on a fix.

A safety mechanism built to absorb losses became the attack surface itself, a reminder that compensation logic added after past incidents carries its own risk once attackers learn to trigger it directly.