MAYAChain halts network after estimated $1.7M exploit
Cross-chain decentralized exchange (DEX) Maya Protocol halted its network after an attacker exploited a series of software flaws to obtain an estimated $1.7 million in crypto.
On Wednesday, Maya Protocol’s pseudonymous co-founder Aalux said the attacker stole about 20 Bitcoin, valued at $1.4 million and another $300,000 in assets. He said the protocol implemented a global halt, contained further damage and started working on a fix to resume swaps.
A preliminary technical analysis shared by Aalux attributed the incident to six chained bugs involving trade accounts, outbound transaction handling and liquidity pool calculations. It said the attacker used a single transaction containing 23 messages to trigger a false theft detection, artificially inflate a low-liquidity pool and withdraw 48.87 million CACAO tokens from Maya’s Asgard module.
The report calculated that about $1.36 million was transferred to external blockchains, while the attacker retained about $291,000 in CACAO and trade-account positions on MAYAChain.
Independent blockchain security researcher Vini Barbosa summarized the findings and noted that CACAO fell by 88.7%, from approximately $0.115 to $0.013 during the incident.
The analysis estimated a wider $10.9 million decline in pool value, but said that figure included arbitrage activity and CACAO’s devaluation rather than assets stolen solely by the attacker.
Related: BitBox patches ‘severe’ wallet flaws that could put funds at risk
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.