Maya Protocol attacked: Approximately $1.7 million was stolen due to six serial vulnerabilities, and the funding pool shrunk by $11 million

Comparatively, the cross-chain liquidity protocol Maya Protocol was attacked on August 18. The attackers used six serial software vulnerabilities to create false account balances and steal about 20.83 BTC (about $1.34 million) and other assets from the protocol's fund pool, with a total direct loss of about $1.65 million. The incident caused the MayaChain network to suspend trading, and its token CACAO plummeted almost 89% from $0.115 to $0.013 before recovering to around $0.03.

Technical review shows that the attack began when MayaChain misjudged that a transaction was lost and triggered a compensation mechanism, but the mechanism miscalculated and added about 49 million CACAO to a small pool of funds, while the agreement reserve was only about 168,000 CACAO. After the transfer failed, the system mistakenly saved a new balance. The attackers then deposited a very small amount into the fund pool, obtained more than 99% of the pool's share, and immediately withdrawn 48.87 million CACAO, which were then exchanged for Bitcoin, Ethereum, and other assets.

As a result of the incident, the total value of Maya Protocol's pool decreased by about $10.9 million, of which about $6.4 million was due to the depreciation of CACAO and about $2.9 million from arbitrage transactions. The team said they hope the attackers will return the funds in the form of bug bounties, otherwise they will make up for losses through channels such as Aztec Chain investments. Maya Protocol has yet to announce when it will resume trading. The incident once again exposed the security risks in the complex logic of DeFi protocols.