Maya Protocol Halted After $1.7 Million in Bitcoin Stolen via Six-Bug Exploit

Maya Protocol's decentralized network, MAYAChain, has been halted after an attacker exploited six software flaws to drain roughly $1.7 million in Bitcoin and other assets.

The attack, which occurred on August 19, 2026, saw the attacker gain control of a liquidity pool by inflating its balance via an uncapped slash subsidy. The team behind Maya Protocol estimated that around $1.65 million was taken, including approximately $1.36 million moved to external blockchains and about $291,000 remaining on-chain.

The bugs exploited in the attack had gone undetected for three to four years despite audits by Halborn and Fable 5. Maya Protocol founder AaluxxMyth, also known as Maya, acknowledged that the team needs to take a more adversarial approach to reviewing its code.

In a post-mortem report, the team revealed that the attacker used a single 23-message MsgDeposit transaction to trigger a false 'theft' detection and inflate the liquidity pool's balance. The team is working on fixing the vulnerability before resuming swaps.