Maya Protocol Loses $1.7M to Six-Bug Chain Attack; CACAO Crashes 89%

Six bugs. One transaction. $1.7 million gone.

Maya Protocol, a cross-chain liquidity protocol built around native Bitcoin swaps, was exploited Wednesday in one of the more technically intricate DeFi attacks of the year. The attacker chained six separate vulnerabilities in a single transaction to drain approximately $1.7 million in Bitcoin and CACAO tokens, the protocol's native asset. Maya halted operations immediately after detecting the breach.

The damage extended well beyond the stolen funds. Total pool value dropped by $11 million as liquidity providers rushed to withdraw, a cascading confidence collapse that dwarfs the direct theft in dollar terms. CACAO fell 89% in the 24 hours following the exploit announcement, essentially wiping out nearly the entire market value of the token in a single session.

Chained exploits of this kind are harder to catch in pre-deployment audits than single-vector attacks. Where a conventional reentrancy bug or price oracle manipulation leaves a clear signature, a six-bug chain requires each individual vulnerability to appear benign in isolation. The attacker only reveals the full attack surface at execution. That design makes static analysis tools and even manual audits less reliable as a sole defense layer, since no single code path triggers an obvious red flag. It also implies the attacker had deep familiarity with Maya's codebase, likely spending significant time reverse-engineering the protocol before deploying the transaction.

The $11 million pool drawdown is the more consequential number for Maya's near-term survival. Liquidity in an automated market maker (AMM) protocol is the product itself: without deep pools, swap fees evaporate, slippage widens, and the protocol becomes functionally unusable. Ronin Bridge and Poly Network both faced analogous crises after their 2022 and 2021 exploits respectively, and while both eventually resumed operations, neither fully recovered their pre-hack liquidity depth for well over a year. Maya's situation is complicated further by CACAO's 89% collapse, which effectively destroys the collateral value of any token-denominated positions and makes recapitalization significantly more expensive.

That said, the fact that Maya's monitoring systems caught the exploit quickly enough to halt operations before further damage is a meaningful data point. A protocol that can stop the bleeding matters. The path back requires a credible post-mortem that identifies all six bugs and their interactions, a third-party audit of the patches, and some mechanism to address losses for affected liquidity providers, whether through a treasury backstop, a token recovery plan, or both. None of that is guaranteed, and the 89% price drop signals that markets are currently pricing in a low probability of full recovery.

For the broader DeFi space, Wednesday's attack is another data point in a pattern: multi-vector exploits are becoming the dominant attack methodology as single-bug opportunities get patched more quickly. Protocols handling native Bitcoin liquidity carry particular risk given the irreversibility of on-chain BTC transactions and the complexity of cross-chain messaging layers that such protocols depend on. Bug bounty programs with meaningful payouts remain underused across the sector relative to the value at risk. A $1.7 million theft from a protocol with tens of millions in TVL (total value locked) is exactly the outcome a well-funded bounty program is designed to prevent.

Maya has not yet published a detailed post-mortem as of this writing. The protocol's next communication will be closely watched.