The cross-chain decentralized exchange (DEX) Maya Protocol has suspended its network operations after a malicious actor leveraged multiple software vulnerabilities to steal crypto assets valued at an estimated $1.7 million. A preliminary analysis of the incident revealed that a complex, 23-message transaction allowed an attacker to drain 48.87 million CACAO, which consequently sent the token's price down by nearly 89%.

On Wednesday, the protocol's pseudonymous co-founder, Aalux, confirmed the breach. He specified that the perpetrator stole approximately 20 Bitcoin, worth $1.4 million, along with an additional $300,000 in other assets. Aalux also stated that the protocol had enacted a global halt to contain any further damage and that the team had immediately started working on a fix to resume swap functionalities.

A preliminary technical analysis shared by Aalux attributed the security incident to six interconnected bugs. The flaws were reportedly related to trade accounts, the handling of outbound transactions, and liquidity pool calculations. According to the report, the attacker utilized a single, complex transaction containing 23 messages. This action was designed to trigger a false theft detection, artificially inflate a low-liquidity pool, and enable the withdrawal of 48.87 million CACAO tokens directly from Maya’s Asgard module.

The analysis further calculated that the attacker successfully transferred about $1.36 million of the stolen funds to external blockchains. At the same time, approximately $291,000 was retained by the exploiter on MAYAChain itself, held in CACAO tokens and various trade-account positions.

Vini Barbosa, an independent blockchain security researcher, summarized the findings from the report and pointed out the severe market impact. During the incident, he noted, the price of the CACAO token plummeted by 88.7%, falling from approximately $0.115 down to $0.013.

The analysis also estimated a much larger $10.9 million decline in the total value of the protocol's pools. However, it clarified that this figure was not solely the amount stolen by the attacker but also included the financial effects of arbitrage activity and the sharp devaluation of the CACAO token that occurred during the exploit.