Maya Protocol halts MAYAChain after about US$1.7 million crypto theft; pool value fell US$10.9 million
An attacker chained six bugs in MAYAChain to forge CACAO and drain about US$1.7M in bitcoin and other assets; trading was halted. Pool value fell US$10.9M. As of early September no restart or full recovery was reported. Users: avoid MAYAChain pools until Maya confirms a fix.
If you provided liquidity to or hold CACAO on MAYAChain, check Maya's official channels for the restart date and any compensation plan before depositing or swapping. Nothing to update on your devices.
What’s happening
On 18 August 2026 Maya Protocol halted trading on MAYAChain, its cross-chain swap network, after an attacker chained six software bugs. A false finding that an outgoing transaction was missing triggered a compensation routine that credited a small liquidity pool with about 49 million CACAO, although the reserve held about 168,000. The attacker took over the pool, withdrew 48.87 million CACAO and swapped it for bitcoin, ether and other assets. Maya put the theft at about 20 BTC plus roughly US$300,000 in other assets, around US$1.7 million. The wider fall in pool value, about US$10.9 million, mostly came from CACAO's near 89% price drop and arbitrage trading, not stolen funds. Maya offered the attacker a bounty for returning the funds and committed US$200,000 of team funds to the pools. An independent analysis on 2 September said the attacker still held most of the bitcoin and had not responded. No report found says trading has resumed or that losses have been made good. Maya has not published a full post-mortem that we found.
- What
- Breach
- Affects
- Maya Protocol MAYAChain cross-chain swap network and CACAO token
- Fixed in
- No fix yet
- Since
- 18 Aug 2026
- Closed
- 2 Sept 2026
Timeline
- UpdateNothing to patch
QuillAudits published an independent analysis. It reports Maya committed US$200,000 of team funds to the pools as a first recovery step and sent the attacker an on-chain bounty offer. It reports about 20.82 BTC still sitting at the attacker's address, some ETH sent to Tornado Cash, and no response from the attacker. It does not say whether trading has resumed.
- UpdateNothing to patch
Maya said the bugs went undetected for three to four years despite audits. It hoped the attacker would return the funds for a bug bounty, and otherwise planned to replace about 20 BTC through Aztec Chain investments and other means.
- UpdateNothing to patch
Reports detailed a chain of six bugs: a false 'missing outbound' finding triggered a payout routine that credited a small pool with about 49 million CACAO against a reserve of about 168,000. The attacker took over the pool, withdrew 48.87 million CACAO and swapped it for bitcoin, ether and other assets. CACAO fell nearly 89% and pool value dropped about US$10.9 million, most of it from the price collapse and arbitrage rather than theft.
- Made publicNothing to patch
Maya Protocol said MAYAChain had been exploited and halted all trading. The team put the loss at about 20 BTC plus roughly US$300,000 in other assets, and said it would work to fix the problem and recover in full.
Sources
- Maya Protocol exploit drains bitcoin and other assets as pool value drops US$11 millionCoinDesk · 19 Aug 2026
- Maya Protocol halts network after bitcoin exploitDecrypt · 19 Aug 2026
- MAYAChain slash subsidy exploit analysisQuillAudits · 2 Sept 2026