Maya Protocol Suffers $11M Liquidity Crash After Chained Accounting Exploit

Maya Protocol, a cross-chain DeFi liquidity protocol, suffered a severe accounting exploit on August 18 that inflated pool balances and allowed an attacker to withdraw approximately $1.36 million in CACAO tokens.

The attack was attributed to six accounting and state-handling flaws chained inside one 23-message transaction, which overwrote outbound state and produced a false missing-transfer signal.

The exploit resulted in the loss of about $10.9 million across the protocol's pools, with approximately $6.4 million attributed to CACAO repricing and $2.9 million due to arbitrage after the token plummeted 88.7% from $0.115 to $0.013.

Maya Protocol founder Aaluxx initially estimated that the network lost about 20 BTC, worth roughly $1.4 million at the time, plus about $300,000 in other assets.