Crypto hacker news: Maya protocol hit six vulnerabilities, losing $1.7 million

Key Points

Crypto Hack News: Maya Protocol suspended due to $1.7 million exploit.

The attacker extracted 48.87 million CACAOs after manipulating pool accounting.

CACAO fell 88.7%, as arbitrage exacerbated broader pool value losses.

Maya Protocol suspended MAYAChain on August 18 after an attacker exploited six interrelated software vulnerabilities. This cryptographic hacking incident resulted in approximately $1.7 million in assets being controlled by the attackers. Maya co-founder Aalux said the team had contained further losses and began to resume work.

This incident is important because a single transaction exploits multiple accounting and execution loopholes. The attacker converts manipulated protocol balances into Bitcoin, Ethereum, RUNE, and stablecoins. This case is also different from a cryptocurrency scam in that the losses were caused by software flaws rather than user fraud.

Crypto Hack News: MAYAChain suspends After Six Exploits

Maya co-founder Aalux said the attacker took about 20 bitcoins and other assets worth $300,000. He said Maya implemented a global pause after detecting the exploit, and the team then began preparing the fix and then resumed redemption.

CertiK Alert alone estimated the loss at close to US$1.7 million. Its assessment classified the incident as a decentralized financial exploit rather than a phishing attack or wallet intrusion. This distinction is important because the attack targets protocol logic and pool accounting.

Independent security researcher Vini Barbosa said six vulnerabilities constitute a chain of attacks. His analysis pointed out that a transaction contained 23 messages and triggered most of the activity. This sequence affects trading accounts, outbound transaction processing, and liquidity pool calculations.

Barbosa said the attacker extracted approximately $1.36 million into an external blockchain. He estimated that after taking into account the market impact, the total impact of the agreement was close to $11 million. This broader number includes arbitrage activity and CACAO devaluations, not just stolen assets.

How exploit manipulates pool accounting

Barbosa's technical summary states that bulk deposit messages overwrite ObservedTxVoter records. The final donation message replaced previous voter data and reset the outbound height. This changes the way MAYAChain evaluates subsequent outbound transactions.

Subsequently, the outbound matcher used the wrong height when checking for legal transfers. Barbosa said the system classifies real outbound transactions as missing. This erroneous result activates theft detection logic within the protocol.

The next vulnerability involves the low-liquidity ARB.LINK pool and its valuation calculations. Barbosa said subsidy calculations lacked an upper limit linked to the actual pool depth. This calculation yielded an accounting value of approximately 49.45 million CACAOs.

Another execution vulnerability occurs in the pool state before the module transfer is completed. Barbosa said that the reserve only held about 168,000 CACAOs, so the transfer of funds failed. The handler logged an error, but continued execution without undoing the previous status update.

The attacker then added negligible liquidity to the inflated pool. Barbosa pointed out that the position gained 99.93% ownership, and the attackers later withdrew 48.87 million CACAOs. The attacker then converted some of the tokens into external assets.

Crypto Hack News: CACAO Plunge exacerbates pool losses

Barbosa traced CAO from approximately US$0.115 to US$0.013 during the incident, a drop of 88.7% and completed in less than 240 blocks. The drastic repricing amplified losses in pools that held CACAO along with other assets.

CoinGecko data later showed that CACAO was around US$0.123 on August 19. The price data shows a recovery from reported exploits lows. Low liquidity and trading interruptions complicate direct comparisons between exchanges during the suspension period.

CoinDesk reported from preliminary analysis that the broader pool dropped to approximately $10.9 million. This figure includes the impact of arbitrage and CACAO repricing, and therefore does not represent assets directly controlled by the attacker.

This distinction also limits comparisons with loss estimates for conventional cryptocurrency scams. Exploitation accounting may include stolen assets, unrecovered agreement balances, and secondary market impacts. These categories measure different forms of damage.

Crypto Hack News: Recovery Work and Next Step in Cyberaction

Aalux said Maya will work to repair the affected code and recover the damage. His public statement also confirmed that the Internet suspension remains part of the response. Among the referenced updates, Maya has not yet published a verified recovery time.

Maya documentation describes network solvency and security controls as core protocol functions. This exploit suggests that interactive security measures may still fail when multiple edge conditions occur simultaneously. The preliminary review focuses on these combined implementation paths.

Barbosa stated that the same attack vector cannot currently be implemented on THORChain. This assessment was for the specific sequence of vulnerabilities described in Maya's preliminary review and did not confirm that there were no other unrelated vulnerabilities.

The next verifiable development is a network restart or technical patch announcement for Maya. Traders can also pay attention to whether the team releases a final loss accounting. These updates should clarify restored assets and remaining agreed liabilities.