Direct answer: Maya Protocol halted its MAYAChain cross-chain network after a reported exploit that extracted approximately $1.65 million to $1.7 million in Bitcoin and other crypto assets. Preliminary technical reporting says the attacker chained six software failures in a 23-message transaction, causing a liquidity pool to record roughly 49 million CACAO that was not properly funded. The attacker then used a small deposit to obtain control of the distorted pool and withdraw a large CACAO balance. CACAO fell roughly 89% during the incident, while the estimated decline in the value of Maya’s liquidity pools reached about $10.9 million. Those figures are different: the first describes direct extraction; the second includes token repricing and arbitrage.
Key takeaways for traders and liquidity providers
- MAYAChain was halted to contain further damage; a restart or recovery plan was not yet confirmed in the sources reviewed for this article.
- The preliminary exploit path depended on multiple failures working together, not one isolated bug.
- The attacker’s reported haul was mostly about 20 BTC, plus other assets; Bitcoin.com News reported 20.82730682 BTC in the linked address at publication.
- CACAO’s collapse created a second wave of damage as arbitrage traders exchanged cheap CACAO for assets in other pools.
- A pool-value decline should not be reported as the amount stolen. It includes the market value of CACAO falling and the effect of arbitrage.
- The most important next volatility signals are the network’s status, movement of the traced BTC, the bug-bounty outcome, and whether swaps resume with credible remediation.
What happened to Maya Protocol and MAYAChain?
Maya Protocol is a cross-chain liquidity network built from THORChain’s open-source code. Its network is designed to let users swap native assets across blockchains, while CACAO acts as a common gas and settlement asset inside MAYAChain’s liquidity system.
On August 18–19, 2026, the team halted network activity after an attacker exploited a sequence of accounting and transaction-processing flaws. CoinDesk reported that the attacker drained about 20 BTC, worth roughly $1.4 million at the time of reporting, along with approximately $300,000 in other assets. Cointelegraph separately described the direct loss as approximately $1.7 million and reported that Maya co-founder Aalux said the halt was intended to prevent further damage.
This was therefore not simply a CACAO price crash: an accounting failure moved from an internal record to real external assets. Token price risk and protocol solvency risk must be assessed separately.
Visual credit: Original LiveVolatile editorial diagram, created August 19, 2026. It summarizes the preliminary mechanics reported by CoinDesk and Cointelegraph; it is not an independent forensic audit. Source context: CoinDesk’s exploit report and Cointelegraph’s technical summary.
How the six-bug chain reportedly created an attackable balance
The available reporting describes six narrow failures compounding: MAYAChain treated an outgoing transfer as missing, activated compensation logic, and credited nearly 49 million CACAO to a small pool even though the reserve held only about 168,000 CACAO. The funding transfer failed, but the inflated record reportedly remained.
The attacker then added negligible liquidity, acquired more than 99% of the distorted pool, withdrew about 48.87 million CACAO from Asgard, and swapped it for Bitcoin, Ether, and other assets. Cointelegraph described the activity as a 23-message transaction. Selling and arbitrage then pushed CACAO from about $0.115 to as low as $0.013, a reported decline of roughly 89%.
Direct loss versus total liquidity damage
The two headline numbers should be kept separate:
| Measure | Reported estimate | What it means |
|---|---|---|
| Direct attacker extraction | About $1.65M–$1.7M | BTC and other assets attributed to the attacker’s withdrawal and subsequent movements |
| Bitcoin traced | About 20–20.83 BTC | Bitcoin.com News reported 20.82730682 BTC in a linked address at publication |
| CACAO decline | Roughly 89% | Reported move from approximately $0.115 to $0.013 during the incident |
| Liquidity-pool value decline | About $10.9M | Includes direct impact, CACAO repricing, and arbitrage; not equivalent to stolen funds |
CoinDesk estimated that much of the broader pool-value loss reflected CACAO becoming less valuable and traders arbitraging the price dislocation. A headline that calls the full $10.9 million “the hack” would therefore overstate what the cited analysis supports.
Why this exploit can create outsized crypto volatility
Why the fallout can be outsized
CACAO’s thinner liquidity can magnify an unbacked balance and make prices unreliable. Because MAYAChain connects native assets on different blockchains, BTC or other assets that leave the protocol cannot simply be reversed at the base layer. Arbitrage can also transfer losses between pools, making the incident appear larger than the attacker’s original withdrawal. Finally, a halt removes normal exit and price discovery; a restart without clear fixes could create another repricing event.
What should traders monitor next?
- Official network status: Look for a Maya Protocol announcement covering the halt, remediation, audits, and restart conditions.
- The traced Bitcoin address: Bitcoin.com News reported about 20.83 BTC in a linked address. Movement to an exchange, bridge, or mixer could change short-term risk, but attribution can evolve.
- Pool reconciliation: Watch remaining BTC, ETH, stablecoin, CACAO, and LP balances—not only a recovery headline.
- Recovery negotiations: A bug-bounty recovery would be material, but would not replace verification of the fix.
- Swap resumption: Evaluate any restart alongside code changes, independent review, limits, and user communications.
- CACAO market structure: Watch depth, spreads, and volume as well as price; a bounce can occur while liquidity remains poor.
Use LiveVolatile’s crypto volatility guide and volatility tools for range and liquidity context—not proof of solvency.
FAQ
How much did the Maya Protocol attacker steal?
Reporting from CoinDesk, Cointelegraph, and Bitcoin.com News placed the direct loss at approximately $1.65 million to $1.7 million, including roughly 20 BTC and other assets. The estimated $10.9 million decline in pool value includes CACAO’s repricing and arbitrage, so it should not be treated as the amount stolen.
What caused CACAO to fall?
The reported exploit created a large, apparently unbacked CACAO balance. The subsequent withdrawal and selling, followed by arbitrage across MAYAChain pools, pushed CACAO sharply lower. Reports described a fall of roughly 89%.
Is MAYAChain still halted?
Reports said Maya halted the network. Verify current status through official channels; a resumed interface is not proof of a safe restart.
Does this mean all cross-chain DEXs are unsafe?
No. It shows that cross-chain systems combine bridge, accounting, liquidity, and transaction risks. Review independent audits, invariant checks, safe failure handling, transparent reserves, and incident response.
Should traders buy CACAO after the crash?
A sharp decline is not a recovery signal. CACAO may remain exposed to halted swaps, thin liquidity, incomplete remediation, disputed balances, and further selling.
Conclusion
The Maya incident shows how a cross-chain accounting error can become a liquidity shock. Reports put direct extraction near $1.7 million and wider pool-value damage near $10.9 million after CACAO’s collapse and arbitrage.
Separate token price action from protocol solvency, distinguish stolen assets from repricing losses, and wait for verified remediation before treating a rebound as stabilization.
Disclaimer: This article is informational, not investment, trading, cybersecurity, or liquidity-provision advice. Crypto assets and DeFi protocols can lose value rapidly.
Sources
- CoinDesk: Maya Protocol exploit drains bitcoin and other assets as pool value drops $11 million, published August 19, 2026; accessed August 19, 2026.
- Cointelegraph: Maya Protocol hit by $1.7M exploit, CACAO falls 89%, published August 19, 2026; accessed August 19, 2026.
- Bitcoin.com News: PeckShield: Maya Protocol loses $1.7M, 20 BTC traced to wallet, published August 19, 2026; accessed August 19, 2026.
— Marcus Reynolds, Senior Crypto Volatility Analyst