Maya Protocol Loses Approximately $1.7 Million Due to Exploitation of Six Vulnerabilities, Over 20 BTC Affected

Multiple bugs were exploited in a chain reaction, leading MAYAChain to halt its network.

The cross-chain DEX (decentralized exchange) Maya Protocol has been attacked, resulting in the loss of approximately $1.7 million (around 270 million yen) worth of cryptocurrency.

The attackers combined six vulnerabilities present within the protocol to manipulate internal accounting and liquidity pools, causing assets including over 20 BTC to be drained. To prevent further damage, Maya Protocol has halted its network and is working on fixes and recovery efforts.

The attackers executed a single transaction containing 23 messages, overwriting the transfer records, which caused the protocol's theft prevention mechanisms to malfunction. This led to an incorrect calculation of compensation amounts for the low liquidity Arbitrum Chainlink (ARB.LINK) pool, resulting in approximately 49.45 million CACAO being recorded as the pool balance.

Subsequently, the attackers added a small amount of liquidity to acquire 99.93% of the pool and withdrew 48.87 million CACAO from Asgard, which holds the protocol's assets. Analysis indicates that 48.87 million CACAO and 9,882 LINK were obtained, along with 20.83 BTC being moved externally.

The physical assets transferred to external blockchains amount to over $1.36 million (around 216 million yen), and including the remaining CACAO and other assets within MAYAChain, the total profit gained by the attackers is estimated to be around $1.7 million.

CACAO Price Plummets by Approximately 89%, Pool Value Decreases by About $10.9 Million

In this attack, in addition to the direct outflow of assets, there was a significant impact on MAYAChain's liquidity pool.

According to independent blockchain security researcher Vini Barbosa, the price of CACAO dropped from approximately $0.115 before the attack to about $0.013, marking a decline of 88.7%.

Preliminary analysis estimates that including the impact of the price drop of CACAO and arbitrage trading, the overall value lost in MAYAChain's liquidity pool is around $10.9 million (approximately 1.73 billion yen). However, this figure does not represent the amount directly stolen by the attackers but includes the decrease in the pool's valuation.

In response to the incident, Maya Protocol has halted its network to prevent further damage. Aalux stated that the team is working on fixes and liquidity recovery to resume swaps, and they plan to seek the return of stolen funds from the attackers through a bug bounty program.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.