Incident Overview
On August 19, 2026, cross-chain liquidity network Maya Protocol was exploited for approximately $1.7 million in assets (including 20.83 BTC valued at ~$1.4M), leading to an overall liquidity pool valuation drop of ~$11 million.
The exploit targeted Trade Accounts (ported from THORChain in mid-2025) that were never integrated into Maya's solvency checker (vault.Coins) or outbound transaction-matching logic. The attacker deposited 8 ETH and 2 LINK into trade accounts, then submitted a 23-message MsgDeposit batch consisting of 22 trade withdrawals (each incremented by ~263 units to prevent outbound batching) and 1 donation. Because the nodes observed 22 simultaneous L1 outbounds unmatched by standard TxOutItems, the security system incorrectly flagged the attacker's own legitimate withdrawals as external theft.
This false alert triggered the automated subsidizePoolsWithSlashBond() theft-compensation handler. Lacking an upper cap, the handler attempted to dump ~49.42 million CACAO into the pools to compensate for the non-existent theft. Although the transaction failed on-chain due to insufficient reserve funds (~168,000 CACAO actual reserve), a state accounting flaw saved the inflated pool balance regardless. Having pre-positioned in an almost empty ARB.LINK liquidity pool with 100 CACAO, the attacker withdrew 99% of their LP position, extracting 48,869,502 CACAO. The attacker then executed 10 consecutive CACAO-to-BTC swaps, siphoning 20.83 BTC directly to a Bitcoin address and triggering secondary arbitrage extraction across the network.
Key Attacker Bitcoin Address: bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Maya Protocol, these are the critical security checks that could have prevented this incident (August 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Maya Protocol
The Maya Protocol hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.