MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage

MAYAChain's attacker moved about $1.36 million in hard assets to external chains, while the estimated impact across the network's liquidity pools approached $11 million.

The $1.36 million figure tracks assets that left the system, including roughly 20.83 BTC. The larger estimate captures a cascade inside the pools: false accounting created a huge CACAO balance, that balance became withdrawable, and CACAO's subsequent collapse repriced the network's remaining liquidity.

Maya Protocol operates MAYAChain as a cross-chain liquidity network where users trade against pooled assets. Its CACAO token connects those markets, which allowed a failure that began in one pool to spread through the value recorded elsewhere.

Founder Aaluxx said on Aug. 18 that the team would fix the incident and “recover in full.” As of the Aug. 20 reporting cutoff, Maya's official channels had not yet published a confirmed swap restart, the patch deployed on mainnet, an asset-recovery total, a final loss allocation, or comprehensive compensation terms for liquidity providers.

How an unfunded balance became withdrawable

The exploit turned an accounting entry that the reserve could never fund into a liquidity position the attacker could use.