Six-Bug Exploit Halts Maya Protocol After $1.4 Million in Bitcoin Stolen

Cross-chain liquidity network Maya Protocol halted operations Tuesday after an attacker exploited six software flaws to drain roughly $1.7 million in Bitcoin and other assets.

In a post on X explaining what happened, Maya Protocol founder AaluxxMyth, also known as Maya, said the team halted the network to contain the damage and would fix the vulnerability before resuming swaps.

“No way to sugar coat this,” Maya wrote in a post. “We have likely been exploited by 20 BTC ($1.4M) and other assets ($300k).”

Maya Protocol operates MAYAChain, a decentralized network that lets users swap cryptocurrencies such as Bitcoin and Ethereum across blockchains without using a centralized exchange.

In a post-mortem report, the team behind Maya Protocol said the attacker exploited six bugs to inflate a liquidity pool by 49.45 million CACAO, then gained 99.93% control of the pool and withdrew 48.87 million CACAO.

“The attack used a single 23-message MsgDeposit transaction to trigger a false “theft” detection, inflate a low-liquidity pool’s CACAO balance via an uncapped slash subsidy, then immediately LP’d into and withdrew from the inflated pool to extract the value,” they wrote.

As the attacker swapped the tokens for Bitcoin and other assets, CACAO’s price collapsed, limiting the amount ultimately extracted. The team estimated the attacker took roughly $1.65 million in crypto assets, including $1.36 million moved to external blockchains and about $291,000 remaining on-chain.

The team did not say whether it believes AI was used in the attack. Maya said the bugs had gone undetected for three to four years despite audits by Halborn and Fable 5, adding that the team needs to take a more adversarial approach to reviewing its code.

“We have to get even more adversarial and look for extremely simple code primitives,” Maya wrote in a follow-up post. “We already knew our job was difficult, but the mission is worth it.”

Maya Protocol published the suspected attacker’s Bitcoin address, which received 20.83 BTC worth about $1.34 million. The team estimated roughly $1.65 million was taken in total and said it hopes the funds will be returned in exchange for a bug bounty.

If not, Maya said the team plans to recover the roughly 20 BTC through investments in Aztec Chain and “other means” and return it to the affected pool.

The news comes after several major DeFi exploits in recent months.

In April, attackers drained roughly $292 million from KelpDAO’s cross-chain bridge after a social engineering attack compromised a developer’s session keys.

In July, Arbitrum-based perpetuals exchange Ostium lost roughly $18 million after attackers compromised an oracle signer key and manipulated its price feed. Later that month, AFX Trade was drained of roughly $24 million in an exploit targeting a USDC bridge operated by the decentralized exchange.