Maya Protocol halts operations after $1.7M Bitcoin exploit

Cross-chain DeFi took another hit this week. Maya Protocol, the Cosmos SDK-based liquidity network, suspended all operations after an attacker chained together six separate software vulnerabilities to drain roughly $1.7 million in Bitcoin and other assets from the platform. The protocol’s native token, CACAO, did not take the news well. Its price collapsed 88.7% in a single day, falling from approximately $0.115 to as low as $0.013 before staging a partial recovery. How the exploit worked The attacker exploited a chain of six distinct software flaws that together allowed manipulation of the protocol’s liquidity pool accounting. By inflating the recorded balance of a pool, the exploit generated an artificial payout of roughly 49 million CACAO tokens into a low-liquidity environment. From there, the attacker withdrew approximately 48.87 million CACAO and used that position to extract around 20.83 BTC, worth between $1.34 million and $1.4 million at the time, along with additional assets sent to external chains. Aalux, Maya Protocol’s pseudonymous co-founder, confirmed the exploit’s mechanics publicly. The team moved immediately to halt all activity on the MAYAChain network to prevent...