Six small bugs, one $1.7M drain — how a cross-chain swap network broke itself

Maya Protocol halted its MAYAChain network after an attacker chained six separate software bugs together and walked away with roughly $1.7 million in crypto. Co-founder Aalux said about 20 BTC, worth around $1.4 million, plus another $300,000 of assets left the network. Swaps are stopped while the team works on a fix.

MAYAChain is a smaller cross-chain trading network, built from THORChain's open-source code, that lets people swap assets like bitcoin and ether without routing them through a centralised exchange. Trades happen against liquidity pools — piles of crypto that users deposit so others can trade against them — and its CACAO token is the common asset connecting those markets.

According to a preliminary technical reconstruction shared by the founder, the attack started when a transaction overwrote the records that track outgoing transfers, making them look like they had gone missing. That triggered a safety mechanism meant to compensate a pool after a theft. The mechanism calculated wrong and credited a small Arbitrum Chainlink pool with about 49 million CACAO, even though the protocol's reserve held only around 168,000 CACAO. The payment failed, but the inflated balance had already been written to the network's records and was never reversed. The attacker then deposited a negligible amount into the distorted pool, ended up owning more than 99% of it, withdrew 48.87 million CACAO, and began swapping those tokens for the real bitcoin, ether and other assets sitting in MAYAChain's pools.

The knock-on damage was much larger than the theft. CACAO fell from about $0.115 to as low as $0.013, a drop of nearly 89%, before recovering to around $0.03. The analysis estimates MAYAChain's pools lost about $10.9 million in value overall — but only around $1.65 million of that was the attacker's actual haul. Roughly $6.4 million was simply CACAO becoming worth less, and about $2.9 million came from arbitrage traders buying the suddenly cheap token and swapping it for assets in the pools. Total pool damage and amount stolen are not the same number, and headlines often blur the two.

The team said it hopes the attacker returns the funds in exchange for a bug bounty, and that it would work to replace the roughly 20 BTC otherwise. Worth noting: fixing the software does not by itself restore the pools, because much of the CACAO conjured by the exploit was swapped into other markets and is now mixed in with tokens belonging to ordinary liquidity providers.

The beginner lesson here is not that cross-chain swapping is doomed — it is that money you deposit into a liquidity pool lives inside that protocol's own bookkeeping. Every one of the six bugs was narrow on its own; the loss came from them lining up. On a smaller network, a single accounting failure can hit both the token you hold and the pool you deposited into at the same time. This is information, not advice.