A preliminary analysis says six chained bugs let a 23-message transaction drain 48.87 million CACAO, sending the token down nearly 89%.
Cross-chain decentralized exchange (DEX) Maya Protocol halted its network after an attacker exploited a series of software flaws to obtain an estimated $1.7 million in crypto.
On Wednesday, Maya Protocol’s pseudonymous co-founder Aalux said the attacker stole about 20 Bitcoin, valued at $1.4 million and another $300,000 in assets. He said the protocol implemented a global halt, contained further damage and started working on a fix to resume swaps.
A preliminary technical analysis shared by Aalux attributed the incident to six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. It said the attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool and withdraw 48.87 million CACAO tokens from Maya’s Asgard module.
The report calculated that about $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on MAYAChain.
Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO fell by 88.7%, from approximately $0.115 to $0.013 during the incident.
The analysis estimated a wider $10.9 million decline in pool value, but said that figure included arbitrage activity and CACAO’s devaluation rather than assets stolen solely by the attacker.
Related: BitBox patches ‘severe’ wallet flaws that could put funds at risk
Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.
All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.
