Maya Protocol exploit drains bitcoin and other assets as pool value drops $11 million

Maya Protocol halted its MAYAChain network after an exploit exposed a chain of six software flaws that let an attacker create a false liquidity-pool balance and drain real assets, including about 20.83 BTC worth roughly $1.34 million plus other tokens. While the direct attacker extraction was about $1.65 million, the broader fallout was much larger: CACAO collapsed nearly 89% intraday, arbitrage activity accelerated the dislocation, and total pool value fell by an estimated $10.9 million. The incident highlights how a cross-chain accounting bug can rapidly cascade into outsized losses, especially in small liquidity pools. Maya said it is working on a fix, has stopped trading to contain damage, and hopes to recover funds via a bug bounty or replacement financing if assets are not returned.