Maya Protocol Pools Remain Exposed After $10.9M Exploit
Maya Protocol's liquidity crisis has left its pools exposed after an attacker exploited six accounting and state-handling flaws on August 18. The suspected Bitcoin address still held approximately $1.59 million in BTC with no outgoing spend as of August 21.
The exploit, attributed to SigIntZero, overwrote the outbound state, producing a false missing-transfer signal that activated a compensation path crediting about 49.45 million CACAO to a thin ARB.LINK pool despite Maya's reserve holding only about 168,000 CACAO.
Maya Protocol founder Aaluxx initially estimated the network had lost around $1.4 million in BTC and $300,000 in other assets. However, SigIntZero estimated that about $10.9 million was impacted by the exploit, with $6.4 million attributed to CACAO repricing and $2.9 million due to arbitrage.
Maya Protocol has not yet published a final pool ledger or compensation terms for those affected, leaving uncertainty over who will absorb the losses from the exploit.