MAYAChain, a cross-chain liquidity protocol, was drained in a sophisticated exploit that chained together six separate bugs in its own code. The attacker walked away with roughly $1.7 million in assets, and the network’s native token, CACAO, collapsed by 88.7 percent as the attack played out. An on-chain forensic reconstruction of the incident, verified against MAYAChain’s node data, lays out exactly how a single actor turned a set of code flaws into near-total control of one of the protocol’s pools.
How the attack unfolded
This was not a single mistake but a chain of them. The attacker linked six distinct bugs across MAYAChain’s deposit and outbound-handling code, using each to set up the next. The sequence ran roughly as follows:
- The attacker triggered a false theft detection in the protocol, causing it to misread a legitimate action as a loss.
- That false signal was used to inflate a near-empty ARB.LINK liquidity pool, distorting the pool’s accounting.
- With the pool distorted, the attacker added liquidity that contained no real assets and, through the bug chain, was credited with 99.93 percent ownership of the pool.
- Holding almost the entire pool, the attacker then withdrew 48.87 million CACAO from Asgard, the protocol’s vault.
The forensic report traces the flaws to specific files in MAYAChain’s open-source node code, including its deposit handler, common outbound handler, shared helper functions, and observed transaction outbound logic. Because the bugs were chained, none of them alone would have been enough; the combination let the attacker manufacture ownership out of nothing.
What left the protocol
Beyond the CACAO, the attacker moved real value off MAYAChain. Around $1.36 million in hard assets left the protocol, led by roughly 20.8 bitcoin worth about $1.34 million, together with smaller amounts on Arbitrum:
- Approximately 20.8 BTC, valued at around $1.34 million, was sent to an attacker-controlled Bitcoin address.
- 6.03 ARB.ETH and 98.82 ARB.LINK, the latter worth about $1,384, on Arbitrum.
Counting the CACAO the attacker still holds, the total take comes to roughly $1.7 million. The damage to the wider network was larger. CACAO fell from about $0.115 to a low near $0.013, down 88.7 percent, over roughly 153 blocks. Factoring in both the assets extracted and the collapse in CACAO’s value, the report puts the total impact on the protocol at around $11 million.
MAYAChain’s response
MAYAChain halted the network after identifying the exploit, cutting off further outflows. The team has said it intends to make affected users whole, and it has offered the attacker a bounty in exchange for returning the funds, a route that several protocols have used to recover assets after similar incidents. The protocol’s co-founder, Aaluxx (@AaluxxMyth), acknowledged the incident publicly:
Why it matters
The MAYAChain exploit reminds us that in cross-chain DeFi, the most dangerous failures are rarely a single obvious hole. Here, six individually smaller bugs combined into a path that gave one actor 99.93 percent ownership of a pool with no genuine capital at stake. For protocols that hold pooled user funds across multiple chains, the episode underlines how much rests on the correctness of deposit and outbound accounting, and how a false internal signal, once triggered, can cascade through the rest of the system.
Security researchers including PeckShield flagged the incident as it unfolded.
