Maya Protocol halts network after $1.7 million exploit drains crypto assets

Maya Protocol halted its cross-chain network on August 19, 2026, after an attacker exploited six chained software bugs to drain approximately $1.7 million in cryptocurrency, including 20 Bitcoin. The exploit triggered a false theft alert and bookkeeping errors, allowing the attacker to withdraw 48.87 million CACAO tokens. The incident caused the CACAO token price to plunge 89% and led to a wider $10.9 million decline in liquidity pool value due to arbitrage and token devaluation.

Maya Protocol exploit mechanics

• ▪The attacker retained approximately $291,000 in CACAO holdings and trade-account positions on MAYAChain after the August 19, 2026 exploit.
• ▪The attacker deposited a small amount of cryptocurrency into the distorted Maya Protocol liquidity pool, gaining over 99% ownership of it before withdrawing CACAO tokens.
• ▪An attacker executed the August 19, 2026 Maya Protocol exploit using a single transaction containing 23 messages to manipulate the network's transaction and accounting systems.
• ▪Following the August 19, 2026 exploit, the attacker transferred approximately $1.36 million in stolen assets to external blockchains, including 20.83 Bitcoin worth about $1.34 million.
• ▪During the August 19, 2026 exploit, the attacker withdrew 48.87 million CACAO tokens from Maya Protocol's Asgard module after artificially inflating the value of a low-liquidity pool.

CACAO token price collapse

• ▪The price of Maya Protocol's CACAO token fell by approximately 88.7% during the August 19, 2026 exploit, dropping from around $0.115 to $0.013.
• ▪The collapse of the CACAO token price during the August 19, 2026 exploit prompted arbitrage traders to buy the devalued token and exchange it for other assets in MAYAChain's pools.

Liquidity pool value losses

• ▪Maya Protocol's team stated they would work to replace the stolen Bitcoin through investments in Aztec Chain and other means if the attacker does not return the funds.
• ▪Of the $10.9 million decline in Maya Protocol's pool value, roughly $6.4 million was due to CACAO's devaluation and $2.9 million resulted from arbitrage trading.
• ▪The total value of Maya Protocol's liquidity pools declined by approximately $10.9 million during the August 19, 2026 exploit.

Network halt emergency response

• ▪Maya Protocol's pseudonymous co-founder Aalux announced on August 19, 2026, that the protocol activated a global halt to stop further losses from the exploit.
• ▪Maya Protocol halted its MAYAChain network on August 19, 2026, to investigate the exploit and develop software fixes before resuming cross-chain swaps.

Six chained software bugs

• ▪A bookkeeping bug in MAYAChain saved an incorrect 49 million CACAO balance in the network's records and failed to reverse it when the transfer failed.
• ▪During the August 19, 2026 exploit, a bug triggered code meant to compensate a liquidity pool after a false theft alert, incorrectly adding 49 million CACAO to a pool despite the reserve holding only 168,000 CACAO.
• ▪The August 19, 2026 exploit of Maya Protocol was made possible by six separate software bugs involving trade accounts, outbound transaction processing, and liquidity pool calculations working in sequence.

3 sources