On Aug. 18 Maya Protocol, a cross-chain DeFi liquidity protocol, suffered a chained accounting exploit that inflated pool balances and let an attacker withdraw roughly 48.87 million CACAO, sending about $1.36 million to external chains and leaving attacker-controlled value near $1.65–1.7 million while still holding 20.82731228 BTC (about $1.59M) as of Aug. 21. A technical reconstruction blamed six accounting/state-handling flaws in a 23-message transaction and estimated total pool damage at about $10.9 million after CACAO plunged from ~$0.115 to $0.013 (an 88.7% decline); Maya has not published a recovery plan to cover the remaining losses, raising security and liquidity risks for token holders and pools.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

The suspected Bitcoin address at the center of Maya Protocol’s Aug. 18 exploit still held about 20.8273 BTC with no outgoing spend on Aug. 21, while no published recovery plan accounted for the much larger estimated impact across the cross-chain liquidity protocol’s pools.

MAYAChain's $1.36 million exploit spiraled into nearly $11 million of pool damage

Public Bitcoin data showed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none waiting in the mempool. Ten initial deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, while a later 546-satoshi transaction raised the total slightly. At today's Bitcoin price, the balance was worth about $1.59 million.

Maya Protocol founder Aaluxx initially said the network had likely lost about 20 BTC, worth roughly $1.4 million at the time, plus about $300,000 in other assets. He said he would work to fix the incident and recover in full.

The next DeFi drain could come from legacy contracts everyone forgot

Why replacing 20 BTC would not make pools whole

A technical reconstruction by SigIntZero attributed the exploit to six accounting and state-handling flaws chained inside one 23-message transaction. It said overwritten outbound state produced a false missing-transfer signal, activating a compensation path that credited about 49.45 million CACAO to a thin ARB.LINK pool even though Maya’s reserve held only about 168,000 CACAO.

The reserve transfer failed, but the inflated balance persisted. After adding negligible liquidity, the attacker received about 99.93% of the pool’s ownership units and withdrew roughly 48.87 million CACAO before swapping into assets held by other MAYAChain pools.

SigIntZero estimated that about $1.36 million in assets moved to external chains and roughly $291,000 remained on MAYAChain, putting total attacker-controlled value near $1.65 million to $1.7 million.

Separately, the pool was impacted by $10.9 million. CryptoSlate analysis attributed about $6.4 million to CACAO repricing and about $2.9 million to arbitrage after the token fell from roughly $0.115 to $0.013, an 88.7% decline.

Maya reportedly hopes for a bug-bounty return and, failing that, could seek to replace roughly 20 BTC through Aztec Chain investments and other means. Even if that Bitcoin is returned or replaced, it would cover only one part of the damage. As of press time, Maya had not publicly defined which remaining losses it would restore or who would absorb the gap created by CACAO’s repricing and trades during the dislocation.