A sophisticated exploit targeting Maya Protocol, a leading cross-chain decentralized exchange, forced the platform to freeze all activity on Wednesday after an attacker walked away with an estimated $1.7 million in digital assets. As per reports, pseudonymous co-founder Aalux confirmed the attacker made off with approximately 20 Bitcoin, worth roughly $1.4 million at the time, plus an additional $300,000 in other assets before the team managed to trigger a network-wide halt and stop the bleeding.
Engineers at Maya Protocol have since shifted into damage-control mode, working on fixes needed before swap functionality can safely resume. A preliminary technical writeup shared by Aalux paints a picture of an unusually coordinated attack, one that didn’t rely on a single point of failure but instead chained together six separate software bugs spanning trade accounts, outbound transaction processing, and liquidity pool math.
What makes this incident notable is how the attacker orchestrated the whole sequence. Rather than executing multiple separate transactions that might have raised red flags along the way, the exploit was packed into a single transaction containing 23 messages, all fired in one coordinated burst. According to the preliminary findings, the attacker’s first move involved tricking the protocol’s own theft-detection system into misfiring, effectively disarming one of Maya’s built-in safeguards before the real attack began.
From there, the attacker turned attention to a pool with thin liquidity, artificially inflating its value to create an opening. That manipulation gave the attacker enough leverage to pull 48.87 million CACAO tokens out of Maya’s Asgard module, a component responsible for holding assets the protocol uses to facilitate swaps across different blockchains. Roughly $1.36 million worth of those assets ultimately made it out to external chains, based on the preliminary accounting, while another $291,000 remained parked in CACAO holdings and trade-account positions still sitting on MAYAChain itself.
Independent blockchain security researcher Vini Barbosa reviewed the incident and highlighted just how badly CACAO’s price suffered as a result. The token’s value collapsed by 88.7% during the attack window, sliding from around $0.115 down to just $0.013. Separately, the technical analysis flagged a much larger figure, a $10.9 million drop in overall pool value, but researchers cautioned that number reflects broader market effects like arbitrage trading and CACAO’s price collapse, as per reports.
Maya Protocol’s exploit adds to what has already been a costly year for the crypto industry. Meanwhile, data from DefiLlama shows 219 hacks recorded so far in 2026, with combined losses reaching $1.26 billion. That pace compares to all of 2025, which saw fewer individual incidents, 146 in total, yet still produced a higher overall dollar loss of $2.71 billion.
