Maya Protocol has halted its cross-chain network after an attacker exploited six linked software flaws to steal an estimated $1.7 million in Bitcoin and other crypto assets. According to reports from crypto.news and PeckShield, pseudonymous co-founder Aalux confirmed that the attacker took about 20.83 Bitcoin, worth roughly $1.34 million, alongside another $288,000 in assets before the protocol activated a global halt to stop further losses. The network halt was implemented on August 18, 2026, around 17:30 UTC, freezing cross-chain activity while the team investigated the breach. The $1.7 million figure represents just over 10% of Maya's tracked total value locked (TVL), marking a significant hit for a protocol whose CACAO token has a circulating market cap of roughly $10 million and trades around $0.10, down more than 92% from its all-time high of $1.43. As per PeckShield, the attacker moved funds out of Maya's externally-held vaults before the protocol's automated solvency checker and node-level halt mechanisms could fully contain the outflow.
As reported by crypto.news and PeckShield, the attacker combined six separate flaws instead of relying on a single vulnerability, allowing several parts of MAYAChain's transaction and accounting system to be manipulated within the same attack. The breach began with a single transaction that bundled 23 separate instructions, whose structure tricked the network into thinking a theft had occurred. This clobbering effect led to wildly inflated CACAO balances in low-liquidity pools, with the attacker then adding minimal liquidity to these fattened pools to gain near-total ownership. By inflating the value of the low-liquidity pool, the attacker was able to withdraw 48.87 million CACAO tokens from Maya's Asgard module, which holds assets used by the protocol to process cross-chain swaps. The preliminary technical analysis shared by Aalux attributed the incident to these chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. Under Maya's security design, chain-specific trading is meant to auto-pause once solvency deviates beyond safe thresholds, with individual node operators able to trigger a 720-block (roughly one-hour) HaltTrading window that stacks with additional node calls.
According to the preliminary accounting reported by crypto.news, approximately $1.36 million in assets ultimately moved to external blockchains, while another $288,000 remains under the attacker's control through CACAO holdings and trade-account positions on MAYAChain. Independent blockchain security researcher Vini Barbosa noted that CACAO dropped 88.7% during the incident, falling from about $0.115 to $0.013 before recovering to around $0.032. The total decline in pool value reached approximately $10.9 million, though this included both the value of assets directly extracted and the sharp devaluation of CACAO during the incident. The analysis estimated a wider $10.9 million decline in pool value, but noted that figure included both the value of assets directly stolen and the sharp devaluation of CACAO rather than assets stolen solely by the attacker. Maya's post-incident stance historically mirrors THORChain's post-2022 approach: halt trading first, audit and patch the code, then resume operations, rather than issue a treasury-funded bailout. Additional losses tied to arbitrage trading during the crash are distinct from what the attacker personally extracted, with independent arbitrage traders capitalizing on the price dislocation to extract further value from the pools.
Founder AaluxxMyth has publicly acknowledged the incident and pledged to recover losses in full, with the team moving quickly to implement a global crypto trading halt while engineers worked to identify and patch the vulnerability. An offer has been extended to the attacker: disclose the vulnerability publicly in exchange for a white-hat bounty and return of the stolen funds. Separately from immediate response measures, AaluxxMyth signaled plans to accelerate the launch of Aztec Chain, described as a next-generation omnichain DeFi platform built on lessons from Maya, THORChain, and Rujira. Part of any capital raised would reportedly be directed back into Maya's pools to help offset losses — a longer-term funding strategy rather than an immediate fix. Recovery options reportedly include freezing the attacker's remaining CACAO, pursuing recovery of the extracted BTC, and restoring pool liquidity through fresh capital or asset re-injection. A more drastic chain-state rollback has also been floated, though it would require validator coordination and carries trade-offs for legitimate transactions made after the exploit. Notably, the founder stated the exploited bugs went undetected through prior Halborn and Fable 5 security audits, highlighting how even audited DeFi protocols remain exposed to complex, multi-step exploits.
