Maya Protocol Hack: 6 Bugs Trigger $1.7M Exploit and 88% CACAO Crash

Maya Protocol Hack News: Attacker Drains 20.83 BTC and CACAO Tokens Maya Protocol has become the latest DeFi platform hit by a security exploit, with an attacker draining value from its liquidity pools. This Maya Protocol hack news roundup covers what happened, how the crypto hack worked, and the team's recovery response. The breach triggered an emergency halt and sent the protocol's native token sharply lower before a partial rebound began. Maya Protocol Hack: $1.7M Lost in Security Exploit The incident struck the MAYAChain mainnet around 17:30 UTC on August 18, 2026. The attacker's confirmed extraction to external chains totaled roughly $1.36 million, while total attacker value — including funds still held on-chain — approaches $1.7 million. Stolen assets included Bitcoin, ARB-based tokens, and native CACAO. The team immediately halted network operations to limit further losses while working on a fix. Maya Protocol Founder Aaluxx Maya Protocol Hack: Attacker Drains 20.83 BTC and CACAO The attacker's confirmed haul was largely 20.83 BTC, worth approximately $1.34 million, sent to a single Bitcoin address. Separately, the attacker still holds around 8.87 million CACAO on-chain, worth roughly $288,000 at depressed prices — funds that could potentially be frozen. Additional losses tied to arbitrage trading during the crash are distinct from what the attacker personally extracted. How the Maya Protocol Exploit Happened Rather than a single flaw, this breach stemmed from six chained bugs. It began with a batched deposit transaction whose many internal messages caused the system to overwrite tracking records tied to one transaction ID. That clobbering effect led the outbound-verification logic to miss where funds had actually gone, mistakenly flagging a legitimate transfer as theft. The false alarm triggered a slashing calculation with no proper cap, wildly inflating the CACAO balance of a low-liquidity pool. That inflated state was saved before the system attempted to fund it — and when the funding transfer failed, the error was logged but never rolled back, leaving the inflated balance intact. The attacker then added minimal liquidity to this fattened pool, instantly gaining near-total ownership, and withdrew the inflated value. Timeline: From Exploit to $1.3M BTC Extraction Time / Block Event Impact Aug. 18, ~17:30 UTC (block 17977941) 23-message exploit transaction executed Six-bug chain triggered Block 17977971 Attacker adds and withdraws liquidity from inflated pool ~48.87M CACAO extracted Blocks 17977998–17978008 CACAO rapidly swapped into BTC 20.83 BTC moved off-chain Block 17978094 CACAO bottoms out Roughly 88.7% down from pre-exploit levels Block 17978500+ Partial recovery begins CACAO climbs back toward $0.03 CACAO Price Crashes 88% as Pools Take Heavy Losses CACAO token price collapsed from around $0.115 to roughly $0.013 as the exploited funds were swapped into other assets, before partially recovering to the $0.03 range.