Maya Protocol suffered an attack, causing US$10.9 million in value to evaporate from MAYAChain pools.

Cross-chain liquidity protocol Maya Protocol has fallen victim to a security breach, with its MAYAChain network forced to suspend trading due to a series of software flaws. The attacker exploited a combination of six vulnerabilities to manipulate the network’s accounting, inflating roughly 49 million CACAO tokens in one liquidity pool—while the pool’s actual reserves stood at only around 168,000 CACAO. The attacker then deposited assets at low cost to gain over 99% of the pool’s share, withdrew approximately 48.87 million CACAO, and converted it into assets including BTC and ETH. On-chain data shows the attacker transferred out around 20.83 BTC (valued at ~$1.34 million) plus other assets, with total direct profits of roughly $1.65 million, though about 8.87 million CACAO remains in the attacker’s wallet. The attack caused the MAYAChain pool’s value to plummet by approximately $10.9 million. However, analysis indicates not all losses were stolen funds: ~$6.4 million stemmed from CACAO’s price crash, and ~$2.9 million from fund outflows due to arbitrage activities. Post-attack, CACAO’s price dropped from ~$0.115 to a low of $0.013, an almost 89% decline, before rebounding to around $0.03. Maya Protocol’s founder stated the team has suspended all trading to contain losses, is working to fix the vulnerabilities, and hopes the attacker returns funds via the bug bounty program. If the funds cannot be recovered, the team plans to cover the ~20 BTC loss through investments in projects such as Aztec Chain.