Maya Protocol had an unexpected platform halt and quick losses of about $1.7 million due to a sophisticated cross-chain exploit. The attacker gained nearly total control after stealing millions of CACAO tokens, LINK, and Bitcoin from a low-liquidity pool. Furthermore, since the market responded quickly to the attack, losses in larger liquidity pools approached $10.9 million, and the incident caused CACAO to fall by almost 89%.

Low-Liquidity Pool Became the Attack Vector

The Maya Protocol's low-liquidity pool was the target of the exploit, which allowed the attacker to take almost complete control and alter the impacted assets. In the end, the attacker took out 48.87 million CACAO tokens, 98.82 LINK, and almost 20 BTC, making the stolen assets directly worth about $1.7 million.

The token's very low liquidity made the scope of the CACAO extraction especially noteworthy. The harm went beyond the money that was actually seized during the exploit once the attacker-controlled assets started to have an impact on the market.

As a result, Maya's exposure soon spread throughout the market rather than being a loss exclusive to the tainted pool.

CACAO Crashes 88.7% as Losses Spread

The market's immediate response was catastrophic. After the exploit, CACAO fell from roughly $0.115 to $0.013, an 88.7% drop.

The incident's financial impact was exacerbated by that dramatic drop. Due to the ensuing market impact, losses across the larger pools were approaching $10.9 million, notwithstanding the attacker's estimated $1.7 million direct extraction.

A cross-chain exploit involving a low-liquidity asset can swiftly propagate throughout the surrounding market, as evidenced by the gap between the stolen assets and the larger pool losses. The attack became a far bigger liquidity and valuation shock for Maya's ecosystem after the CACAO price crash.

Maya Halts Trading Worldwide

In response, Maya Protocol suspended all global trade, with the primary goal being to stop more harm while the team looked into the exploit.

The attacker's Bitcoin address was also disclosed by founder AaluxxMyth, providing the community with a particular address linked to the fake money. As Maya attempted to control the situation, the manoeuvre increased visibility into the incident.

Additionally, the process halted swaps, thereby limiting additional trading activity while the team evaluated the situation. Since the attacker had already taken Bitcoin, LINK, and CACAO, halting further transactions became essential to the defence.

When the impact of the attack became apparent, Maya decided to halt trading and swaps rather than permit regular business to continue while the vulnerability was being probed.

A hacker just drained a DeFi protocol using six bugs chained into a single transaction

Maya Protocol got hit for $1.7 MILLION and the method is what stands out

By stacking six flaws at once, the attacker fooled the protocol's own safety checks, faked activity in a thin pool and… pic.twitter.com/dEoolwYmNC

— Jeremy (@Jeremybtc) August 19, 2026

Founder Promises Fixes & Faster Aztec Chain Rollout

In addition to the emergency measures, AaluxxMyth offered to support Maya's recovery efforts by implementing Aztec Chain more quickly and providing transparent improvements.

The Maya community, which united behind the protocol in the wake of the exploit and the ensuing market crash, has also supported the response.

While transparent fixes are meant to address the vulnerabilities revealed by the attack, the quicker implementation of Aztec Chain is now being positioned as part of Maya's road to recovery. Recovering from the roughly $1.7 million direct exploit is not the project's only urgent hurdle. The considerably greater market impact, which includes the 88.7% CACAO crash and losses of about $10.9 million across all impacted pools, must also be dealt with.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Harmony ONE Token Crashes After $4B Unauthorized Mint
2. ZachXBT Exposes Alleged $5M Crypto Scam
3. Crypto User Loses $100K to Address Poisoning Scam
4. What the COLDCARD Exploit Means for Crypto?
5. Carrot Shuts Down After Drift Exploit Fallout

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.