Maya Protocol suffered a six-vulnerability attack and lost $1.7 million, DeFi security vulnerability

Maya protocol was hacked, exposing lag of defense tools

This week, the Maya protocol was hacked and attackers exploited a vulnerability, which exposed a bigger problem: defense tools are difficult to keep up with complex hacking methods. Blockchain security company CertiK estimates the total direct losses at approximately $1.7 million. The attacker deceived the Maya protocol to grant a non-existent subsidy, then repeatedly increased and removed liquidity, extracting assets from the shared pool.

The consequences of the attack immediately affected Maya's liquidity providers and CACAO token holders. More importantly, these vulnerabilities are not just a direct result of broken lines of code. Attacks exploit situations where regular protocol logic does not match expected behavior, making such attacks almost impossible to detect until they cannot be stopped.

How attackers manipulated Maya's accounts

According to CertiK (which identified the incident on August 19), the hackers distorted Maya's internal accounts through false subsidies and ultimately extracted approximately 48.87 million CACAOs and 98.82 LINKS by changing liquidity positions. The DeFiLlama Hacking and Exploiting Database classified the August 18 incident as "Protocol Logic" with a loss of $1.7 million.

The greater harm is actually more significant. Developer Vini Barbosa called it a "complex exploitation involving six vulnerabilities" that stole more than $1.36 million in hard assets from the agreement, but considering the collapse in CACAO prices, the overall impact was close to $11 million. According to him, the token fell from $0.115 to $0.013 in less than 240 blocks, a drop of nearly 89%.

Aaluxx, one of Maya's founders, confirmed the damage the same day and said the team would "work hard to repair and fully recover."

A similar pattern that ThorChain has experienced

Maya is a friendly offshoot of ThorChain, which suffered a $10.7 million hack in May. In its post-mortem analysis, THORChain said that a new node operator exploited a vulnerability in the network's GG20 threshold signature system, and the system's solvency check did not realize the problem until after the hacking ended.

Aaluxx later clarified in THORChain's community podcast that the hack was based on three older vulnerabilities that were not dangerous in themselves but could be combined to cause problems. He went on to say that Maya has the same potential flaws.

To determine the cause of the hacking attack, an extremely in-depth forensic investigation is required. The team must check encryption configuration parameters and look for small prime numbers that should not exist to locate infected vaults. This essentially reveals a common flaw for defenders: a simple balance monitor may detect a loss after funds change hands, but at this point may no longer be able to prevent the attack from continuing.

Practical ways to upgrade defenses

Aaluxx warns that AI technology is allowing small teams to study the code base from more angles at the same time. This benefits defenders, but it also means attackers have more ways to discover unique vulnerabilities that existing audit processes may miss.

The solution he chose was redundancy rather than relying on a single system. Instead of adopting an integrated approach, Maya and THORChain chose to remain independent. This allows Maya to continue to use verifiable health vaults to perform swaps while THORChain is down for several weeks.

This comparison is particularly interesting because THORChain's own post-mortem analysis stated that the root cause was not a major flaw, but three older vulnerabilities that became exploitable after being concatenated. THORChain also made it clear that the same potential vulnerability exists on Maya, but has not been exploited before.

Comparison of Maya protocol and THORChain security incidents

Event date: Maya protocol-August 18, 2026 approximately 17:30 UTC;THORChain -May 15, 2026.

Damage: Maya protocol-The attacker's total value is approximately US$1.7 million, of which approximately US$1.36 million was extracted to external chains;THORChain -approximately US$10.7 million was withdrawn from a vault.

Assets affected: Maya Protocol- 20.83 BTC +48.87 million CACAO and other assets;THORChain - BTC, ETH, BNB and Base Chain assets.

Root cause: Maya protocol-six concatenated vulnerabilities involving transaction accounts and outbound process logic, where the attack exploits interactions between non-catastrophic vulnerabilities;THORChain -three older vulnerabilities concatenated, including a vulnerability in the GG20 threshold signature scheme.

Detection/Response: Maya protocol-Attack activity triggers an emergency pause, and the attacker completes exploitation before the network is stopped;THORChain -On-chain investigators (including ZachXBT and PeckShield) flag suspicious activity, and THORChain's automatic control suspends signatures/transactions.

Protocol Relationship: The Maya protocol is a friendly offshoot of THORChain that shares most of the architecture/code;THORChain is the original cross-chain mobility protocol.

Security lessons: Multiple individually manageable vulnerabilities can become catastrophic when combined with liquidity/accounting and outbound process weaknesses; redundancy, automatic detection and signature control can limit the reach of vault damage.

How does the DeFi protocol prevent chain exploitation?

The protocol requires testing the interaction between security controls, not just individual vulnerabilities. The Maya incident showed that false theft detection, flawed outbound transaction processing, and liquidity bookkeeping errors can become dangerous when combined. Stronger defenses include immutability testing, confrontational simulation of multi-step attack paths, independent review of accounting logic, real-time anomaly detection, and automatic circuit breakers for abnormal withdrawals or pool balances. Research released this month also advocates using multiple layers of detection and defense rather than relying on a single security mechanism.

Event timeline

August 18, 2026: Attack occurred. On-chain activity suggests that the attacker exploited MayaChain's accounting/outbound process vulnerability to extract CACAO and BTC. Maya founder Aaluxx publicly described the hacking on August 18. Event date: August 18, 2026.

August 18, 2026:MayaChain suspends transactions/transactions to control attacks and begins repairs. Same event date.

August 18 - 19, 2026: Attack analysis surfaced. Researchers reconstructed a chain of six vulnerabilities, including false theft alarms, false compensation and failed accounting. Considered as a post-mortem analysis and not a secondary event.

August 19, 2026: More extensive reports and technical articles appear. Reports on August 19 described the August 18 attack and rebuilt the damage. Report date: August 19.

August 19, 2026: Some data providers/security sources mark events as August 19, which may reflect their UTC/time zone conventions or the date the event record was created/updated. Without limitation, please do not use this as the date of the main event.

At least some of the differences have specific time zone explanations. For example, KuCoin's event alert stated that MayaChain was hacked on August 19 (UTC+8). This corresponds to evening/night time on August 18 UTC, depending on the transaction timestamp.

CACAO Price and Block Height Attack Timeline

The following block-level data comes from event reconstructions to help connect attack mechanisms, asset withdrawals, and token price damage.

Block 17,977,941: Executed an attack transaction with 23 messages, and launched a six-vulnerability attack chain.

Block 17,977,971: The attacker added/extracted liquidity from the manipulated pool, extracting approximately 48.87 million CACAOs.

Blocks 17,977,998 to 17,978,008:CACAO was quickly converted to BTC, and 20.83 BTC was transferred to the outside world.

Block 17,978,094: CAO reached a post-attack low, down approximately 88.7% from pre-attack levels.

Block 17,978,500+: began to partially recover and CAO recovered to approximately US$0.03.

Damage control

Industry data highlights the importance of strengthening defenses. According to TRM Labs, there were 207 hacking attacks in the cryptocurrency space in the first half of 2026, setting a semi-annual record high, and smart contracts are increasingly being attacked in multiple ways, not just a single vulnerability. Maya vulnerabilities fully align with this trend.

The conclusion is that DeFi cannot be secured without identifying and fixing specific vulnerabilities. Agreements must employ multiple layers of monitoring, independently use multiple review mechanisms, install a rapid suspension mechanism in emergencies, and be able to implement repairs before suspicious transactions become irreversible.

Maya doesn't just want to solve immediate problems. Aaluxx said the company plans to accelerate the development of Aztec Chain, a full-chain DeFi project based on lessons learned from previous projects (Maya, THORChain and Rujira). If these lessons help them build better solutions rather than just restarting the cycle of fixing defects, the value of the Maya event could well exceed the $1.7 million loss.