MAYAChain halts network after estimated $1.7M exploit

Cross-chain decentralized exchange (DEX) Maya Protocol halted its network after an attacker exploited a series of software flaws to obtain an estimated $1.7 million in crypto. 

On Wednesday, Maya Protocol’s pseudonymous co-founder Aalux said the attacker stole about 20 Bitcoin, valued at $1.4 million and another $300,000 in assets. He said the protocol implemented a global halt, contained further damage and started working on a fix to resume swaps.

A preliminary technical analysis shared by Aalux attributed the incident to six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. It said the attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool and withdraw 48.87 million CACAO tokens from Maya’s Asgard module. 

The report calculated that about $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on MAYAChain.

Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO fell by 88.7%, from approximately $0.115 to $0.013 during the incident. 

The analysis estimated a wider $10.9 million decline in pool value, but said that figure included arbitrage activity and CACAO’s devaluation rather than assets stolen solely by the attacker. 

Related: BitBox patches ‘severe’ wallet flaws that could put funds at risk