The suspected Bitcoin address linked to the Aug. 18 exploit of Maya Protocol still held 20.8273 BTC with no outgoing spend as of Aug. 21, according to public blockchain data. The balance comprised 10 initial deposits and a later 546-satoshi transaction.
Maya Protocol founder Aaluxx initially stated that the network lost about 20 BTC alongside approximately $300,000 in other assets, pledging to work toward a full recovery. However, technical analysis indicates that simply replacing the stolen 20 BTC would leave a significant portion of the protocol's damage unresolved.
A technical reconstruction by SigIntZero revealed that the exploit involved six accounting and state-handling flaws executed within a single transaction. The incident produced an inflated balance in an ARB.LINK pool, enabling the attacker to withdraw roughly 48.87 million CACAO and swap it into assets across other MAYAChain pools.
SigIntZero estimated that attacker-controlled assets totaled between $1.65 million and $1.7 million, with about $1.36 million moving to external chains and $291,000 remaining on MAYAChain. Beyond the direct theft, the wider pool impact reached nearly $10.9 million, driven largely by CACAO repricing and subsequent arbitrage following an 88.7% decline in the token's value from roughly $0.115 to $0.013.
While Maya reportedly pursued a bug-bounty return and potential replacement options such as Aztec Chain investments, the protocol had not published a final pool ledger, compensation terms, or details regarding who would absorb the wider losses as of press time.
