MAYAChain Halts After $1.7M Exploit

MAYAChain halted operations after an attacker used a chain of six software vulnerabilities to take about $1.7 million in cryptocurrency. The incident was disclosed Wednesday by the protocol’s pseudonymous co-founder, Aalux, who posted that the attacker removed roughly 20 Bitcoin (about $1.4 million) and about $300,000 in other assets.

Aalux shared a preliminary technical analysis attributing the breach to six linked flaws affecting trade accounts, outbound transaction handling and liquidity pool calculations. The attacker carried out a single transaction composed of 23 messages that triggered a false theft detection, manipulated a low-liquidity pool and enabled the withdrawal of 48.87 million CACAO tokens from the protocol’s Asgard liquidity module.

The analysis found about $1.36 million of the proceeds were moved to external blockchains. It also reported the attacker retained roughly $291,000 in CACAO and open trade-account positions on MAYAChain. The team implemented a global halt to contain losses and began work on a technical fix for swaps and on-chain functions.

Independent blockchain security researcher Vini Barbosa summarized the technical findings and noted a sharp market effect: CACAO’s price dropped about 88.7%, from roughly $0.115 to $0.013 during the exploit. The same analysis estimated a broader $10.9 million decline in pool value; that figure accounts for post-exploit arbitrage activity and CACAO’s devaluation rather than the value taken directly by the attacker.

Aalux wrote, “We implemented a global halt, contained further damage and started working on a fix to resume swaps.” The protocol has not provided a timetable for restoring full operations and did not outline plans for compensating users or recovering transferred funds.

Engineers are investigating the chain of failures and preparing a patch. The probe remains active while the team works toward a controlled restart.