Maya Protocol has undergone a halt after an attacker exploited 6 chained bugs to drain roughly $1.7 million from the decentralized liquidity protocol.

The pseudonymous co-founder, Aaluxx, disclosed the losses. Native token CACAO collapsed by 88% as the attacker converted the stolen supply into Bitcoin (BTC), Ethereum (ETH), and other assets across all Maya liquidity pools.

Maya Protocol Loses $1.7 Million in Latest Hack

The attack involved a single transaction that bundled 23 separate instructions. This structure tricked the network into thinking a theft had occurred.

The protocol then tried to compensate for the pool it believed had been robbed. However, the payout had no upper limit, so the system credited about 49 million CACAO to a pool that held almost nothing.

The credit was never funded. Maya’s reserve held only 168,000 CACAO, so the transfer failed, leaving the inflated balance on the books.

The attacker deposited 100 CACAO into that pool, claimed 99.93% ownership, and withdrew 48.87 million CACAO. That is nearly half the token’s 100 million supply. 

CACAO fell from $0.115 to $0.013 before recovering to around $0.032. The attacker sent 20.83 BTC, worth roughly $1.34 million, to a single Bitcoin address across about 10 blocks.

Founder Aaluxx Myth announced a global halt in the project on Discord and asked the attacker to return the funds.

Follow us on X to get the latest news as it happens

DeFi Hacks Keep Stacking Up in 2026

DefiLlama has logged 219 hacks worth $1.26 billion so far in 2026. All of 2025 produced 146 incidents, even though the dollar total reached $2.71 billion.

August alone has produced 16 separate incidents. THORChain, the protocol Maya forked from, lost $10.7 million in May.

Recovery now depends on whether the attacker accepts the bounty offer. Aaluxx Myth also said the team will contact the arbitrage traders who absorbed the pool value.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto