Maya Protocol loses $1.7M in six-bug exploit

Maya Protocol lost roughly $1.7 million on Aug. 18 after a hacker exploited six bugs in a single transaction, blockchain security firm CertiK said.

The attacker tricked the protocol into crediting a false balance of about 49 million CACAO tokens, even though the underlying pool held only around 168,000 CACAO. That inflated balance remained after a failed transfer. The attacker deposited a small amount, gaining more than 99% of the distorted pool. He then withdrew 48.87 million CACAO and 98.82 LINK, swapping them for Bitcoin and other assets.

The direct loss was $1.7 million, but developer Vini Barbosa said the total impact reached roughly $11 million after CACAO's price collapsed. The token fell from $0.115 to $0.013, a drop of nearly 89%.

Maya co-founder Aaluxx acknowledged the damage and said the team would “work to fix and recover in full.” He later told THORChain’s community podcast that the exploit relied on three older bugs that were harmless individually but dangerous when chained together. The same latent flaw existed on Maya, he said.