Cross-chain DeFi took another hit this week. Maya Protocol, the Cosmos SDK-based liquidity network, suspended all operations after an attacker chained together six separate software vulnerabilities to drain roughly $1.7 million in Bitcoin and other assets from the platform.
The protocol’s native token, CACAO, did not take the news well. Its price collapsed 88.7% in a single day, falling from approximately $0.115 to as low as $0.013 before staging a partial recovery.
How the exploit worked
The attacker exploited a chain of six distinct software flaws that together allowed manipulation of the protocol’s liquidity pool accounting. By inflating the recorded balance of a pool, the exploit generated an artificial payout of roughly 49 million CACAO tokens into a low-liquidity environment.
From there, the attacker withdrew approximately 48.87 million CACAO and used that position to extract around 20.83 BTC, worth between $1.34 million and $1.4 million at the time, along with additional assets sent to external chains.
