Maya Protocol exploit: MAYAChain halted after $1.65M drained from pools
Maya Protocol exploit escalated into a global pause of MAYAChain. On Aug 18, 2026, an attacker used multiple “chained faults” to drain about $1.65 million from MAYAChain liquidity pools, after which the team halted the network.
Key figures reported by the team: the attacker extracted roughly $1.36 million to external blockchains and kept about $291,000 on MAYAChain initially. The project published a Bitcoin inflow address showing 20.83 BTC received (team figures vary slightly by counting method). The main outcome for traders is operational risk: a network halt stops block production, so swaps and liquidity-provider withdrawals cannot move until the restart.
Token impact: the MAYAChain-related token CACAO fell about 88.7%–89% (from around $0.115 to about $0.013), signalling shallow liquidity and fast price pressure.
How it worked (from the post-mortem): a single transaction carrying 23 deposit messages triggered faulty theft-detection/compensation logic without an upper limit. This allowed an artificially inflated pool share, after which the attacker supplied liquidity, held ~99.93% briefly, withdrew ~48.87M CACAO, then swapped the proceeds into BTC and other assets.
What traders should do now: check whether your swap deposits/receipts are “stuck” on the source chain and whether liquidity positions are tied up in the pools. Also avoid post-hack “rescue” links or signing approvals you did not initiate yourself.
Overall, the Maya Protocol exploit is a reminder that non-custodial cross-chain swaps carry smart-contract risk, and halt events can quickly translate into trading and settlement disruption.
Bearish
Bearish in the short term: the Maya Protocol exploit triggered an immediate global halt, freezing swaps and liquidity withdrawals. That typically increases settlement uncertainty and forces risk-off behavior among users, often leading to further sell pressure and impaired liquidity.
The CACAO ~89% drawdown highlights thin depth. In past smaller protocol incidents (including other cross-chain bridge or oracle-driven events), sharp token repricing often lingers as markets discount contract-risk and liquidity risk, even if the total dollar loss is not the largest of the year.
Medium/longer term: recovery depends on whether the team can restore the chain state, rebuild liquidity, and execute any compensation/bug-bounty outcomes. Until then, traders may expect higher volatility and wider spreads around any “restart” headlines. If funds begin to move back on-chain, sentiment can stabilize; if not, the likely outcome is persistent risk premium on related DeFi liquidity and cross-chain routes.