Cross-chain protocol Maya Protocol was attacked, with attackers draining roughly $1.7 M in assets. The bulk of the losses came from 20 Bitcoin worth around $1.34 M, while another $300 K consisted of other assets. Following the incident, the team halted trading across all chains, while its native CACAO token plunged sharply.
A vulnerability in the pool accounting logic allowed the attacker to create an inflated CACAO balance without a corresponding amount of tokens in the reserves. The attacker then gained control of more than 99% of one of the pools and withdrew around 48.87 million CACAO, swapping them for Bitcoin and other assets.
Attack Details
The attack exploited a chain of six vulnerabilities involving trade accounts and balance accounting. In a single transaction containing 23 messages, the attacker triggered a false positive in the theft detection mechanism.
As a result, the system credited a low-liquidity pool with nearly 49 million CACAO, even though its reserves held only around 168,000 tokens. The attacker was unable to withdraw funds from the reserve, but the inflated balance remained in the accounting system.
The attacker then added a minimal amount of liquidity, gained more than 99% ownership of the pool, and withdrew around 48.87 million CACAO. The attacker swapped the tokens for Bitcoin and other assets from Maya Protocol pools. The 20 BTC that were drained remain at a single address and have not moved since the attack.
The token’s total supply remained unchanged at 100 million tokens. The additional tokens existed only in the pools’ accounting records and did not result from the issuance of new CACAO.
Following the attack, the token price fell from $0.115 to $0.013, losing around 89%. It later partially recovered and was trading at around $0.03 at the time of publication. The total value of the protocol’s pools fell by approximately $10.9 M, taking into account changes in the market value of the assets.
Team Statement
The anonymous founder of Maya Protocol, known by the pseudonym Aaluxx, confirmed the attack and said the team was preparing a fix for the vulnerability and working toward fully restoring the lost funds.
To help recover the assets, the project is considering a bug bounty program. If necessary, the team is prepared to compensate for the losses, including through mechanisms related to Aztec Chain.
Read also: