Maya Protocol Halts Operations After Six-Bug Exploit Drains $1.7 Million in Assets

Attack Drains Cross-Chain Protocol

Maya Protocol, a decentralized platform enabling users to swap cryptocurrencies across multiple blockchains without relying on centralized intermediaries, halted operations on Tuesday after suffering a major security breach. In its post-mortem announcement, Maya Protocol detailed that attackers exploited six critical software vulnerabilities to extract approximately $1.7 million in digital assets from the network, with the largest portion—roughly $1.4 million—in Bitcoin. An additional $300,000 in various cryptocurrencies was also stolen.

The security incident triggered a sharp market reaction, with CACAO, the platform’s native token, losing nearly 89% of its value. The overall impact on Maya’s liquidity pools reached approximately $10.9 million in total losses as attackers systematically drained assets from the compromised system.

The Sophisticated Exploitation Technique

In a detailed post-mortem analysis, Maya Protocol’s team revealed the mechanics of the exploit. The attacker executed a single transaction comprising 23 separate messages to manipulate the protocol’s core systems. By exploiting the identified bugs, the attacker artificially inflated a liquidity pool’s CACAO balance by 49.45 million tokens, then achieved control of 99.93% of the affected pool and withdrew approximately 48.87 million tokens.

The attack methodology involved triggering a false security alert within the protocol, which activated an uncapped subsidy mechanism that further amplified the CACAO balance. The attacker then provided liquidity to the now-inflated pool and immediately withdrew the exaggerated value, converting assets to Bitcoin and other cryptocurrencies through the platform itself. The sudden selling pressure caused CACAO’s price to collapse, which paradoxically limited the total value the attacker could ultimately extract from the network.

Security Audits Failed to Detect Vulnerabilities

One of the most troubling aspects involves how long these vulnerabilities persisted undetected. Maya Protocol founder AaluxxMyth, known as Maya, disclosed that the six bugs had existed in the codebase for three to four years without being identified. This is particularly significant given that the protocol underwent security audits conducted by both Halborn and Fable 5, established firms specializing in blockchain security reviews.

Following the exploit, the protocol’s leadership committed to overhauling its security review processes, recognizing the need for more aggressive and adversarial approaches when auditing code fundamentals. The team identified that 20.83 BTC, valued at approximately $1.34 million, was sent to an attacker’s publicly disclosed Bitcoin address. Maya Protocol has appealed to the attacker to return the stolen funds in exchange for a bug bounty reward and indicated plans to pursue additional recovery options involving strategic investments, though specific mechanisms were not fully detailed. For the broader crypto market, this breach demonstrates that sophisticated attack vectors continue to pose significant risks even to established platforms with professional security oversight and audits in place.

Source: Maya Protocol, via Decrypt. Not financial advice.