Maya Protocol Hack Exposes Chained Bugs in DeFi Protocol
The Maya Protocol hack has left the DeFi platform reeling after an attacker exploited six chained bugs, draining $1.7 million from its liquidity pools.
The breach occurred on August 18 at around 17:30 UTC when a batched deposit transaction triggered a series of errors that allowed the attacker to withdraw funds without being detected.
The attack began with a legitimate transfer being flagged as theft, causing the system to wildly inflate the CACAO balance of a low-liquidity pool. The attacker then added minimal liquidity to this pool and withdrew the inflated value, extracting 20.83 BTC worth approximately $1.34 million.
The incident sent the price of CACAO crashing by 88% from around $0.115 to roughly $0.013 before partially recovering to the $0.03 range.
Maya Protocol founder Aaluxx Myth has acknowledged the incident and pledged to recover losses in full, offering a white-hat bounty to the attacker in exchange for disclosing the vulnerability publicly and returning the stolen funds.