MAYAChain exploit moved $1.36M; inflated CACAO caused $11M hit

MAYAChain, the cross-chain liquidity network operated by Maya Protocol, was exploited in mid-August. About $1.36 million in hard assets moved to external chains, including roughly 20.83 BTC. A false accounting entry inflated CACAO balances and contributed to nearly $11 million of losses across the network’s liquidity pools.

Independent researcher Vini Barbosa reconstructed the sequence and traced most activity to a single MsgDeposit transaction that contained 23 messages. He found the final DONATE message overwrote ObservedTxVoter state, including the outbound height used to match transfers. The incorrect height caused the system to mark legitimate outbound transfers as missing and to trigger a theft-detection compensation path.

The compensation routine calculated a subsidy for an ARB pool without bounding the amount relative to the pool’s depth. Barbosa reports the routine recorded about 49.45 million CACAO of value even though the reserve actually held roughly 168,000 CACAO. The module transfer could not be completed because the reserve lacked enough tokens, but the altered pool state was committed and the inflated balance remained in the pool record.

An attacker then added a negligible amount of liquidity to the distorted pool, acquired about 99.93% of its ownership units, and withdrew approximately 48.87 million CACAO. Barbosa attributes roughly $1.36 million in hard assets moved to external chains to the exploit, led by the 20.83 BTC sent out of MAYAChain.

CACAO’s market price fell from about $0.115 to $0.013 during the incident, an 88.7% decline. Because CACAO is one side of many paired liquidity pools, that repricing reduced the recorded dollar value of CACAO holdings across the system even where those tokens remained inside pools. The inflated balance and trades executed against distorted pool prices added further losses, producing a network-wide impact close to $11 million.

Maya Protocol halted swaps using its HALTTRADING control while allowing the chain to continue producing blocks. On Aug. 18, founder Aaluxx posted that the team would fix the incident and “recover in full.” As of Aug. 20, Maya had not published a confirmed swap restart time, the patch deployed on mainnet, a recovered-asset total, a final loss allocation, or compensation terms for liquidity providers.

MAYAChain’s Trade Accounts implementation shows development lineage to THORChain merge requests. Public documentation did not show the exact combination of transaction-state handling, outbound matching, subsidy calculation, pool-state ordering, and rollback behavior that produced the exploit; the incident required specific conditions to align across those systems to turn an unfunded accounting entry into a withdrawable balance.

A full recovery will require returning or replacing hard assets that left the network, repairing pool balances and accounting records, and defining how remaining losses and trades executed during the disruption will be allocated among liquidity providers and other participants. Maya had not released a final ledger dividing the total impact among hard-asset extraction, CACAO repricing, and trades executed during the dislocation.