Maya Protocol Halts Chain After $1.7M Hack Erases $11M in Liquidity Pools
August 19, 2026
A Six-Bug Chain Freezes MAYAChain in Hours
The exploit hit MAYAChain, a Thorchain fork built on the Cosmos SDK, at around 17:32 UTC on August 18. On-chain data compiled by blockchain security firm Peckshield shows 20.83 BTC moving into a single attacker wallet in 10 separate transfers, worth about $1.34 million at the time of the drain. Co-founder Aaluxx Myth announced the network halt shortly after the losses were confirmed, saying operations would stay paused while the team investigated. According to a preliminary breakdown from security researcher Vini Barbosa, the attack relied on “six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations.” The full exploit sequence was executed inside a single 23-message transaction on the network.How the Attacker Turned One Missed Transaction Into $1.7 Million
The trigger, according to CoinTelegraph, was a set of overwritten outbound transfer records that made MAYAChain believe an outgoing transaction had failed. That mistake fired a safety mechanism designed to reimburse a liquidity pool after a theft. The safety code, though, calculated compensation incorrectly. It credited the low-liquidity ARB.LINK pool with roughly 49.45 million CACAO tokens it should never have received. Because that pool held so little real value, the attacker was able to buy up 99.93% of it almost instantly, then withdraw 48.87 million CACAO from Asgard, MAYAChain’s vault system. Around $1.4 million of that was paid out in 20 BTC. Another $300,000 left as ARB-based tokens, Peckshield noted.
What a Cross-Chain Liquidity Pool Actually Is
For beginners, the mechanism at the centre of this story is worth understanding, because the same design underpins a large slice of DeFi. A cross-chain liquidity pool is a shared wallet, controlled by smart contracts, that holds two or more assets from different blockchains. When a user wants to swap Bitcoin for Ether, for example, they deposit BTC into one side of the pool and the protocol releases Ether from the other side. No wrapped tokens, no centralized exchange, and no bank in the middle. Maya Protocol runs its version of this on the Cosmos SDK with Tendermint consensus, letting users move between Bitcoin, Ethereum, USDC and other assets. The tradeoff is that smart contracts have to track many moving parts at once. When one of those parts miscounts, as it did here, the whole pool can be gamed.Why the Pool Damage Reached $11 Million
The $1.7 million the attacker walked away with is only part of the picture. Coindesk reported that the total value locked in Maya’s pools fell by roughly $10.9 million once the effects of the exploit rippled through. CACAO’s price collapse did most of the extra damage. The token dropped nearly 88.7%, from around $0.115 to $0.013 in a matter of hours, according to figures compiled by Barbosa. Arbitrage traders reacting to the price gap and unwinding CACAO positions accelerated the fall, pulling more value out of the paired pools even after the initial drain was over. For context on the BTC price side of the ledger, the attacker’s stash of 20.83 BTC was still parked in a single wallet as of the following morning, giving investigators and any potential negotiator a clear on-chain target.Aaluxx Myth Offers a Bug Bounty as the Chain Stays Halted
Aaluxx Myth publicly asked the attacker to disclose the exploit and return the funds in exchange for a white-hat bug bounty. In parallel, the team said it would seek to restore liquidity lost by affected users and rebuild trust in the pools before the network resumes trading. Traders who prefer to move funds through a centralized route while the halt is in place can still use a best crypto exchange for the same swaps, though at the cost of custody and KYC. There is no public timeline yet for the chain restart. This is the first major security breach for the Maya team since 2023.What the Halt Could Mean for Cross-Chain DeFi in 2026
The Maya incident may put pressure on other Thorchain-style protocols to review their compensation and outbound transfer logic, particularly the code paths that trigger automatically when the network suspects theft. Those safety nets are often the least battle-tested part of a DeFi codebase, precisely because they only run in edge cases. Analysts note that the appetite for cross-chain swaps remains strong, but the bar for smart contract quality could rise if similar chained-bug attacks appear elsewhere. Users looking to buy crypto directly may lean more heavily on protocols with recent audits and public post-mortem histories over the next few weeks. Whether MAYAChain returns with full liquidity or a slimmed-down set of pools will likely depend on how much of the missing value the team can recover through the bug bounty channel.A Reminder That Bridges Remain Crypto’s Weakest Link
Cross-chain bridges and liquidity networks have cumulatively lost more than $1.65 billion to hacks in 2026, according to Peckshield’s running tally. Maya’s $1.7 million drain is small on that scale, but the mechanism—six small bugs chained into one large outcome—is exactly the pattern that has proven hardest for auditors to catch. That combination—high-value shared wallets sitting behind long chains of automated logic—is why bridges remain the single most targeted layer in crypto. Until protocols can prove their edge-case handlers are as robust as their happy paths, individual exploits like this one are likely to keep landing.
Share Article
Madiha Riaz
Madiha is a seasoned researcher in cryptocurrency, blockchain, and emerging Web3 technologies. With a background in organic chemistry and a sharp analytical mindset, she brings scientific depth to decentralized innovation. Since discovering crypto in 2017 and investing in 2018, she’s been uncovering and sharing deep insights into how blockchain is redefining the digital asset landscape.
