Written by Ezra Reguerrastaff writerReviewed by Yohan Yunstaff editor

Written by Ezra Reguerrastaff writer

Reviewed by Yohan Yunstaff editor

MAYAChain halts network after estimated $1.7M exploit

Latest NewsPublishedAug 19, 2026

A preliminary analysis says six chained bugs let a 23-message transaction drain 48.87 million CACAO, sending the token down nearly 89%.

Cross-chain decentralized exchange (DEX) Maya Protocol halted its network after an attacker exploited a series of software flaws to obtain an estimated $1.7 million in crypto. 

On Wednesday, Maya Protocol’s pseudonymous co-founder Aalux stated the attacker stole about 20 Bitcoin, valued at $1.4 million and another $300,000 in assets. He stated the protocol implemented a global halt, contained further damage and started working on a fix to resume swaps.

A preliminary technical analysis shared by Aalux attributed the incident to six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. It stated the attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool and withdraw 48.87 million CACAO tokens from Maya’s Asgard module. 

The report calculated that about $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on MAYAChain.

Independent blockchain security researcher Vini Barbosa summarized the findings and pointed out that CACAO fell by 88.7%, from approximately $0.115 to $0.013 during the incident. 

The analysis estimated a wider $10.9 million decline in pool value, but stated that figure included arbitrage activity and CACAO’s devaluation rather than assets stolen solely by the attacker. 

Related: BitBox patches ‘severe’ wallet flaws that could put funds at risk

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hackers
• Hacks
• Security
• Cybersecurity
• Scams & Cybercrime

More on the subject

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra

DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Aug 16, 2026

Zoltan Vardai

Inside the fake crypto startup that fooled North Korean IT workers

Aug 12, 2026

Yohan Yun

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra

DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Aug 16, 2026

Zoltan Vardai

Inside the fake crypto startup that fooled North Korean IT workers

Aug 12, 2026

Yohan Yun