Maya Protocol Hit by Complex Hack as CACAO Plunges Nearly 89%

Maya Protocol has been hit by a complex exploit in which an attacker used multiple vulnerabilities in sequence. According to initial analyses, the attacker managed to siphon around $1.36 million to external blockchains. The total value attributed to the attacker, including CACAO left behind, is around $1.65 million. The attack has meanwhile sent shockwaves through CACAO, which lost nearly 89% of its value within a few hundred blocks.

Attacker combines six vulnerabilities

The attack took place on 18 August and, according to the technical analysis, centres on six bugs that amplified one another. Using a single transaction made up of 23 messages, the attacker was able to manipulate the accounting of a liquidity pool.

In the end, the attacker briefly held around 99.93% of an artificially inflated pool. From the Asgard module, 48.87 million CACAO was then withdrawn.

Large amounts of CACAO were subsequently swapped for other assets. Around 20.83 Bitcoin, worth approximately $1.34 million, was sent to an external Bitcoin address. ETH and LINK were also used during the attack, among others.

CACAO crashes from $115 to $13

The impact on CACAO is extreme. Before the exploit, the token was trading at around $115. Under the selling pressure, the price fell to a low of roughly $13. That represents a crash of 88.7% within about 237 blocks.

Some recovery followed to around $32, but CACAO still remains more than 70% below its pre-attack level.

MayaChain stepped in quickly and halted operations to prevent further damage. The team says it wants to fix the bug before swaps are resumed.

The developers also hope the attacker will be willing to return stolen funds in exchange for a bug bounty. The team says it is working on a plan to compensate liquidity providers, pointing among other things to investments linked to Aztec Chain.

The exact financial damage is more complex than just the amount the attacker managed to take. Because of the sudden CACAO crash, other traders carried out arbitrage, which also removed assets from the pools. It will become clear in the coming period how much value can ultimately be recovered.