Six-Bug Exploit Halts Maya Protocol After $1.4 Million in Bitcoin Stolen

In brief

• Maya Protocol halted MAYAChain after an attacker extracted roughly $1.7 million in Bitcoin and other assets.
• A post-mortem identified six bugs that created a false balance in a liquidity pool.
• CACAO plunged nearly 89% as the value of MAYAChain's liquidity pools fell by roughly $10.9 million.

Cross-chain liquidity network Maya Protocol halted operations Tuesday after an attacker exploited six software flaws to drain roughly $1.7 million in Bitcoin and other assets.

In a post on X explaining what happened, Maya Protocol founder AaluxxMyth, also known as Maya, said the team halted the network to contain the damage and would fix the vulnerability before resuming swaps.

"No way to sugar coat this," Maya wrote in a post. "We have likely been exploited by 20 BTC ($1.4M) and other assets ($300k)."

Maya Protocol operates MAYAChain, a decentralized network that lets users swap cryptocurrencies such as Bitcoin and Ethereum across blockchains without using a centralized exchange.

In a post-mortem report, the team behind Maya Protocol said the attacker exploited six bugs to inflate a liquidity pool by 49.45 million CACAO, then gained 99.93% control of the pool and withdrew 48.87 million CACAO.