Maya Protocol Halts Operations Following $1.7 Million Exploit

The attack involved a single transaction containing 23 messages, which allowed the perpetrator to manipulate trade accounts, outbound transaction processing, and liquidity pool calculations. By triggering a false theft-detection mechanism, the attacker successfully inflated a low-liquidity pool to withdraw 48.87 million CACAO tokens from the protocol’s Asgard module. According to co-founder Aalux, roughly $1.36 million in assets was bridged to external blockchains, while another $291,000 remains trapped in attacker-controlled positions on the network.

Following the breach, the price of the CACAO token plummeted by 88.7%, dropping from $0.115 to $0.013. While technical reports suggest the total decline in pool value reached approximately $10.9 million, developers clarified that this figure includes arbitrage activity and the sharp market devaluation rather than direct theft. The protocol remains offline as engineers work to patch the underlying vulnerabilities, with no definitive timeline provided for a full restoration of services.