$1.7M Crypto Exploit Forces MAYAChain to Suspend Operations
Initial investigation reveals a complex attack leveraging six interconnected vulnerabilities allowed a 23-message transaction to extract 48.87 million CACAO, causing the token to plunge approximately 89%.
Maya Protocol, a cross-chain decentralized exchange platform, suspended its network operations following a sophisticated exploit that allowed an attacker to siphon approximately $1.7 million worth of cryptocurrency through a sequence of software vulnerabilities.
Maya Protocol's pseudonymous co-founder, Aalux, disclosed on Wednesday that the malicious actor made off with roughly 20 Bitcoin, worth approximately $1.4 million, along with an additional $300,000 in various digital assets. According to Aalux, the protocol executed a global network halt, successfully prevented additional losses and began developing a solution to restore swap functionality.
An initial technical investigation posted by Aalux identified the attack as stemming from six interconnected vulnerabilities related to trade accounts, the handling of outbound transactions and calculations within liquidity pools. The analysis revealed that the exploiter deployed a singular transaction comprising 23 messages to activate a fraudulent theft detection mechanism, artificially boost a pool with minimal liquidity and extract 48.87 million CACAO tokens from the Asgard module of Maya.
According to the report's calculations, approximately $1.36 million was moved to external blockchain networks, while the exploiter maintained roughly $291,000 worth of CACAO and positions within trade accounts on the MAYAChain platform.
Vini Barbosa, an independent researcher specializing in blockchain security, provided a summary of the investigation's results and observed that CACAO experienced a dramatic 88.7% price collapse, dropping from around $0.115 to approximately $0.013 throughout the exploit.
The technical analysis projected a broader $10.9 million reduction in total pool value, though it clarified that this number encompassed arbitrage trading operations and the devaluation of CACAO itself, not exclusively assets directly taken by the attacker.