Cross-chain DeFi took another hit this week. Maya Protocol, the Cosmos SDK-based liquidity network, suspended all operations after an attacker chained together six separate software vulnerabilities to drain roughly $1.7 million in Bitcoin and other assets from the platform.
The protocol’s native token, CACAO, did not take the news well. Its price collapsed 88.7% in a single day, falling from approximately $0.115 to as low as $0.013 before staging a partial recovery.
How the exploit worked
The attacker exploited a chain of six distinct software flaws that together allowed manipulation of the protocol’s liquidity pool accounting. By inflating the recorded balance of a pool, the exploit generated an artificial payout of roughly 49 million CACAO tokens into a low-liquidity environment.
From there, the attacker withdrew approximately 48.87 million CACAO and used that position to extract around 20.83 BTC, worth between $1.34 million and $1.4 million at the time, along with additional assets sent to external chains.
Aalux, Maya Protocol’s pseudonymous co-founder, confirmed the exploit’s mechanics publicly. The team moved immediately to halt all activity on the MAYAChain network to prevent further losses while the investigation proceeded. Security firm PeckShield also began monitoring on-chain activity tied to the incident.
The direct theft totaled roughly $1.7 million. But the broader damage to liquidity pools, amplified by the market reaction and CACAO’s collapse, pushed total losses across the protocol to an estimated $11 million in value.
Why cross-chain accounting is a recurring weak point
Maya Protocol is built as a non-custodial fork of THORChain, itself a Cosmos SDK-based network. The core pitch for both protocols is the same: let users swap native assets across blockchains without wrapping tokens or relying on bridges.
Cross-chain systems have to track balances across multiple independent ledgers simultaneously. When the accounting layer between those ledgers can be manipulated, the consequences compound fast. An inflated number on one side of the equation becomes real money extracted on the other side.
THORChain, Maya’s architectural predecessor, has experienced its own serious exploits. In 2021, the network suffered multiple attacks within a short window, losing millions across separate incidents.
What this means for Maya and the broader DeFi landscape
For liquidity providers on the platform, the situation is painful. An 88.7% single-day drop in CACAO means that any holdings denominated in the token lost the vast majority of their value before most users could react. The pool-level losses, estimated at $11 million when accounting for both the direct theft and the subsequent market dislocation, represent real capital that may not be fully recoverable depending on how the protocol structures any remediation.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
