On Aug. 19, 2026, cross-chain DEX Maya Protocol halted its network after an exploit. Co-founder Aalux said the attacker took roughly 20 BTC (about $1.4 million) plus about $300,000 in other assets, around $1.7 million in total.
Preliminary analysis points to six chained bugs involving trade accounts, outbound transaction handling, and liquidity pool calculation. A single transaction with 23 messages triggered a false theft detection and withdrew 48.87 million CACAO from the Asgard module. About $1.36 million moved to external blockchains, while roughly $291,000 stayed behind.
CACAO fell about 88.7% during the incident, from $0.115 to $0.013. The protocol applied a global halt while it works on a fix.
Cointelegraph (Ezra Reguerra); MAYAChain co-founder Aalux statement