How the Attack Succeeded
This week, Maya Protocol suffered a hacker attack, where the attacker exploited a vulnerability that exposed a deeper issue: defense tools lag behind when dealing with sophisticated attacks. Blockchain security firm CertiK estimates the direct loss at approximately $1.7 million, with the attacker extracting assets from shared pools by inducing Maya to issue non-existent subsidies and repeatedly adding and removing liquidity.
CertiK identified the incident on August 19. The attacker caused Maya's internal accounting to become distorted through false subsidies, then adjusted liquidity positions to extract approximately 48.87 million CACAO and 98.82 LINK. DefiLlama's hacker and vulnerability database classifies the event that occurred on August 18 as a "protocol logic vulnerability," with losses of $1.7 million.
But the actual damage goes far beyond that. Developer Vini Barbosa called it a "complex six-vulnerability chain exploit," extracting over $1.36 million in hard assets from the protocol, but due to the collapse of CACAO's price, the overall impact approached $11 million. He stated that CACAO fell from $0.115 to $0.013 in less than 240 blocks, a drop of nearly 89%.
One of Maya's founders, Aaluxx, acknowledged the loss on the same day and added that the team would "work hard to fix and fully recover."
A Pattern THORChain Has Experienced
Maya is a friendly fork of THORChain, which suffered a $10.7 million hack in May. THORChain's post-mortem revealed that a new node operator exploited a vulnerability in the network's GG20 threshold signature system, and the system's solvency checks did not detect the problem until after the attack ended.
Aaluxx later clarified on THORChain's community podcast that this attack was based on three old vulnerabilities that were not dangerous individually, but could cause problems when combined. He also stated that Maya had the same underlying flaws.
To determine the cause of the attack, the team conducted an extremely in-depth forensic investigation, examining cryptographic configuration parameters and looking for small primes that should not exist to locate the compromised vault. This revealed a common dilemma for defenders: simple balance monitors can only detect losses after funds have changed hands, at which point it may be too late to prevent the attack from continuing.
What Upgrading Defense Really Means
Aaluxx warned that AI technology is enabling small teams to review codebases from more angles simultaneously, which benefits defenders, but also allows attackers to discover more unique vulnerabilities that existing audit processes might miss.
The solution he chose is redundancy, rather than relying on a single system. Instead of integrating, Maya and THORChain chose to remain independent. This way, even if THORChain is down for weeks, Maya can continue executing swaps through a verified healthy vault.
This contrast is particularly interesting because THORChain's post-mortem pointed out that the root cause was not a dramatic flaw, but three old vulnerabilities chained together. THORChain also explicitly stated that the same underlying flaws existed on Maya but had not been exploited before.
Maya vs THORChain Security Incident Comparison
| Metric | Maya Protocol / MAYAChain | THORChain |
|---|---|---|
| Incident Time | August 18, 2026, 17:30 UTC | May 15, 2026 |
| Loss | Total value to attacker approximately $1.7 million, with about $1.36 million extracted to external chains | Approximately $10.7 million drained from one vault |
| Affected Assets | 20.83 BTC + 48.87 million CACAO and other assets | BTC, ETH, BNB, and Base chain assets |
| Root Cause | Six chained vulnerabilities involving Trade Account and outbound liquidity logic, exploiting interactions between non-catastrophic bugs | Chain exploit of three old vulnerabilities, including a flaw in the GG20 threshold signature scheme |
| Detection/Response | Attack activity triggered emergency pause, but the attacker completed the exploit before the network stopped | On-chain investigators like ZachXBT and PeckShield flagged suspicious activity, then THORChain's automatic controls paused signing/transactions |
| Protocol Relationship | MAYAChain is a friendly fork of THORChain, sharing most of the architecture/code | The original cross-chain liquidity protocol |
| Security Lessons | Multiple individually manageable bugs can become catastrophic when combined with liquidity/accounting and outbound flow weaknesses | Redundancy, automated detection, and signing controls can limit the blast radius of a compromised vault |
How Can DeFi Protocols Prevent Chain Exploits?
Protocols need to test interactions between security controls, not just individual vulnerabilities. The Maya incident shows how false theft detection, erroneous outbound transaction handling, and liquidity accounting errors can become dangerous when combined. Stronger defenses should include invariant testing, adversarial simulation of multi-step attack paths, independent review of accounting logic, real-time anomaly detection, and automatic circuit breakers for abnormal withdrawals or pool balances. Research published this month also advocates for multi-layered detection and defense rather than relying on a single security mechanism.
Attack Timeline
Regarding the date discrepancy, there is a specific timezone explanation: some data providers' alerts marked the event as August 19 (UTC+8), corresponding to the evening of August 18 UTC. Therefore, the August 19 date marked by some data providers is actually the date the record was created or updated.
Block-level data shows the attack chain:
- Block 17,977,941: The exploit transaction containing 23 messages executed, starting the six-vulnerability chain.
- Block 17,977,971: The attacker added/removed liquidity in the manipulated pool, extracting approximately 48.87 million CACAO.
- Blocks 17,977,998–17,978,008: CACAO was rapidly swapped for BTC, with 20.83 BTC transferred out.
- Block 17,978,094: CACAO fell to its post-attack low, down approximately 88.7% from pre-attack levels.
- Block 17,978,500+: Partial recovery began, with CACAO rebounding to around $0.03.
Loss Control and Industry Context
Industry data highlights the importance of strengthening defenses. TRM Labs reported that the cryptocurrency sector experienced 207 hacks in the first half of 2026, a record high for a half-year period, and noted that smart contracts are increasingly being attacked in multiple different ways rather than through a single vulnerability. The Maya incident fits this trend perfectly.
The conclusion is that DeFi security cannot be ensured without identifying and fixing specific vulnerabilities. Protocols must adopt multi-layered monitoring, multiple independent review mechanisms, emergency rapid pause mechanisms, and implement fixes before suspicious transactions become irreversible.
Maya is not just trying to solve the current problem. Aaluxx said the company plans to accelerate development of Aztec Chain—an omnichain DeFi project built on lessons learned from Maya, THORChain, and Rujira. If these lessons can help build better solutions rather than simply restarting the cycle of patching flaws, then the value of the Maya incident may far exceed the $1.7 million loss.
