Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

The suspected address has spent nothing, while Maya has not detailed who absorbs the wider repricing and arbitrage damage.

Quick Take

01 The suspected Bitcoin address still held 20.8273 BTC on Aug. 21 with no outgoing spend after Maya Protocol’s Aug. 18 exploit.

02 SigIntZero estimated about $1.65 million to $1.7 million in attacker-controlled assets and nearly $10.9 million in wider pool impact.

03 Maya has not published a final pool ledger, compensation terms, or who will absorb losses from CACAO repricing and arbitrage.

The suspected Bitcoin address at the center of Maya Protocol’s Aug. 18 exploit still held about 20.8273 BTC with no outgoing spend on Aug. 21, while no published recovery plan accounted for the much larger estimated impact across the cross-chain liquidity protocol’s pools.

MAYAChain's $1.36 million exploit spiraled into nearly $11 million of pool damage

Public Bitcoin data showed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none waiting in the mempool. Ten initial deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, while a later 546-satoshi transaction raised the total slightly. At today's Bitcoin price, the balance was worth about $1.59 million.

Maya Protocol founder Aaluxx initially said the network had likely lost about 20 BTC, worth roughly $1.4 million at the time, plus about $300,000 in other assets. He said he would work to fix the incident and recover in full .

The next DeFi drain could come from legacy contracts everyone forgot

Why replacing 20 BTC would not make pools whole

A technical reconstruction by SigIntZero attributed the exploit to six accounting and state-handling flaws chained inside one 23-message transaction. It said overwritten outbound state produced a false missing-transfer signal, activating a compensation path that credited about 49.45 million CACAO to a thin ARB.LINK pool even though Maya’s reserve held only about 168,000 CACAO.

The signal, before the noise.

Start your day with the crypto stories moving markets, decoded by CryptoSlate’s editors.

Weekday mornings

5-minute read

One email. Everything that matters.

Free to join. Unsubscribe any time.

The reserve transfer failed, but the inflated balance persisted. After adding negligible liquidity, the attacker received about 99.93% of the pool’s ownership units and withdrew roughly 48.87 million CACAO before swapping into assets held by other MAYAChain pools.

SigIntZero estimated that about $1.36 million in assets moved to external chains and roughly $291,000 remained on MAYAChain, putting total attacker-controlled value near $1.65 million to $1.7 million.

Separately, the pool was impacted by $10.9 million . CryptoSlate analysis attributed about $6.4 million to CACAO repricing and about $2.9 million to arbitrage after the token fell from roughly $0.115 to $0.013, an 88.7% decline.

Maya reportedly hopes for a bug-bounty return and, failing that, could seek to replace roughly 20 BTC through Aztec Chain investments and other means. Even if that Bitcoin is returned or replaced, it would cover only one part of the damage. As of press time, Maya had not publicly defined which remaining losses it would restore or who would absorb the gap created by CACAO’s repricing and trades during the dislocation.

DeFi hacks are turning high yields into a hidden liquidity tax

Bitcoin

Bitcoin is +1.19% over the past 24 hours and currently sits at rank # 1 by market cap.

Mentioned in this article

Editorial credits

Also known as "Akiba," Liam Wright is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate. He believes that decentralized technology has the potential to make…

Related coverage

Adam Back’s Bitcoin treasury deal died, but its $15M obligation did not

More coverage

Ethereum researchers are racing to close a zkEVM security gap before December

A $22.9 million capital deficit threatens to derail an energy firm’s pivot to off-grid Bitcoin mining

The latest $1.61 billion crypto ETF surge risks grinding to a halt against a 30-year US Treasury yield spike

CryptoSlate may use AI tools to support research, editing, and production workflows. Our journalism remains human-led, with our editorial team responsible for every published article. Read our full AI usage disclaimer .

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article.

Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers .

Follow the signal

Curated intelligence, delivered your way.