.png){kind=logo}
Maya Protocol halted MAYAChain on August 18 after an exploit drained Bitcoin and other crypto assets. The attack targeted a liquidity pool through six software bugs and created a false CACAO balance. The incident caused around $1.7 million in direct asset losses and pushed total pool value down nearly $11 million.
The attacker exploited MAYAChain after its accounting system added nearly 49 million CACAO without enough reserves. The pool held only about 168,000 CACAO before the faulty balance appeared. A small deposit then gave the attacker more than 99% control of the manipulated pool. The attacker withdrew 48.87 million CACAO before swapping the tokens for Bitcoin and Ethereum.
Around 20 BTC accounted for most of the directly stolen assets, according to Maya Protocol. Pseudonymous co-founder Aaluxx also reported personal losses linked to the incident. The protocol stopped swaps, deposits and withdrawals while developers investigated the exploit and formulated a fix.
Aaluxx addressed the incident on X, saying, “Will work to fix and recover in full. We carry on.”
The exploit also hit the CACAO token sharply as traders reacted to the sudden liquidity imbalance. The token reportedly fell from above $0.11 toward $0.013 during the market fallout. The wider pool losses reached about $11 million after trading activity and liquidity effects.
Maya Protocol plans to seek fund recovery through a bug bounty offer for the attacker. The team also expects to restore around 20 BTC if recovery efforts fail. Most exploited CACAO remains spread across MAYAChain markets, making full recovery more difficult.
The incident adds pressure to an already troubled DeFi security landscape. Data cited by Gadgets 360 shows 83 crypto protocol hacks occurred during the second quarter of 2026.
Also Read: Crypto Custody: How Institutions Safely Store Digital Assets
