{"id":12148,"date":"2026-08-20T19:27:13","date_gmt":"2026-08-20T19:27:13","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12148"},"modified":"2026-08-20T19:27:13","modified_gmt":"2026-08-20T19:27:13","slug":"mayachains-1-36-million-exploit-spiraled-into-nearly-11-million-of-pool-damage","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12148","title":{"rendered":"MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage"},"content":{"rendered":"

<\/p>\n

\n

MAYAChain’s attacker moved about $1.36 million in hard assets to external chains, while the estimated impact across the network’s liquidity pools approached $11 million.<\/p>\n

The $1.36 million figure tracks assets that left the system, including roughly 20.83 BTC. The larger estimate captures a cascade inside the pools: false accounting created a huge CACAO balance, that balance became withdrawable, and CACAO’s subsequent collapse repriced the network’s remaining liquidity.<\/p>\n

Maya Protocol operates MAYAChain as a cross-chain liquidity network where users trade against pooled assets. Its CACAO token connects those markets, which allowed a failure that began in one pool to spread through the value recorded elsewhere.<\/p>\n

Founder Aaluxx said on Aug. 18 that the team would fix the incident and \u201crecover in full.\u201d As of the Aug. 20 reporting cutoff, Maya’s official channels had not yet published a confirmed swap restart, the patch deployed on mainnet, an asset-recovery total, a final loss allocation, or comprehensive compensation terms for liquidity providers.<\/p>\n

How an unfunded balance became withdrawable<\/h2>\n

The exploit turned an accounting entry that the reserve could never fund into a liquidity position the attacker could use.<\/p>\n

Independent researcher Vini Barbosa traced most of the activity to one MsgDeposit transaction containing 23 messages. In his reconstruction, the final DONATE message overwrote earlier ObservedTxVoter state, including the outbound height used to match transactions.<\/p>\n

That wrong height made MAYAChain classify legitimate outbound transfers as missing. The classification activated theft-detection logic designed to compensate a pool after a missing transfer.<\/p>\n

The compensation path then calculated a subsidy for a near-empty ARB pool without bounding the amount to the pool’s depth. Barbosa said the calculation recorded roughly 49.45 million CACAO of value even though the reserve held only about 168,000 CACAO.<\/p>\n

The reserve lacked enough tokens to complete the module transfer, but the new pool state had already been committed. According to Barbosa, the handler continued after the failed transfer and left the inflated balance in place.<\/p>\n

The attacker added a negligible amount of liquidity to the distorted pool and received about 99.93% of its ownership units, enabling a withdrawal of roughly 48.87 million CACAO.<\/p>\n

The overwritten height produced false theft detection, the false signal generated an excessive subsidy, the failed subsidy survived in pool records, and the recorded balance then supported a dominant liquidity claim.<\/p>\n

Barbosa’s reconstruction attributes the exploit to that combined path. He\u00a0put hard assets moved to external chains at about $1.36 million, led by 20.83 BTC. His estimate for the network-wide impact was close to $11 million.<\/p>\n

The token fell from about $0.115 to $0.013 during the incident, an 88.7% drop.<\/p>\n

CACAO represents one side of MAYAChain’s paired liquidity pools. A sharp decline in its dollar price reduces the measured value of CACAO inventory across the system, even when those tokens remain inside a pool.<\/p>\n

The exploit-created balance and trades executed against distorted pool prices added another layer of pool impact.<\/p>\n