Maya Protocol has halted its network after an attacker exploited a chain of software flaws and extracted an estimated $1.7 million in crypto assets. The shutdown was described as a global halt intended to contain further damage while the team works on a fix to restore swaps.

According to pseudonymous co-founder Aalux, the stolen funds included about 20 Bitcoin, valued at roughly $1.4 million, as well as another $300,000 in other assets. The figures are based on an initial assessment released after the incident.

Attack linked to multiple bugs

A preliminary technical analysis said the exploit was not caused by a single defect but by six bugs used together. The issues were said to involve trade accounts, outbound transaction handling and the way liquidity pool balances were calculated.

The report said the attacker sent one transaction containing 23 messages. That sequence allegedly triggered a false theft-detection event, inflated a low-liquidity pool and enabled the withdrawal of 48.87 million CACAO tokens from Maya’s Asgard module.

Estimated losses and asset flows

The protocol’s early estimate put the direct loss at about $1.7 million. Of that amount, roughly $1.36 million was said to have been moved to external blockchains, while the attacker was reported to still hold about $291,000 in CACAO and trade-account positions on MAYAChain.

Aalux said the Bitcoin portion of the theft amounted to around 20 BTC. Based on the team’s estimate, that accounted for most of the losses, with the remainder spread across other assets.

CACAO slumps during the incident

Independent security researcher Vini Barbosa summarized the preliminary findings and highlighted the market impact on CACAO. During the incident, the token fell 88.7%, dropping from about $0.115 to roughly $0.013.

The analysis also pointed to a broader $10.9 million decline in pool value. However, it said that figure should not be treated as the amount stolen by the attacker alone, because it also reflected arbitrage activity and the sharp devaluation of CACAO.

What happens next

For now, Maya Protocol says the network-wide halt remains in place as the team works on remediation. The stated goal is to resume swaps once a fix is ready.

Beyond the immediate recovery effort, the clearest confirmed facts so far come from the preliminary technical review and the co-founder’s loss estimate. Further updates are likely to determine whether those numbers change and when normal network activity can restart.

Source: cointelegraph.com