MayaChain experienced an exploit on August 18 that allowed an attacker to move about $1.36 million in assets, including roughly 20.83 BTC, to external chains and caused estimated damage of around $11 million across its liquidity pools. Founder Aaluxx said on August 18 that the team would fix the issue and recover in full, but as of the August 20 cutoff no confirmed details about a swap restart, patch deployment, asset recovery total, or compensation terms had been published.

The exploit originated from a single MsgDeposit transaction containing 23 messages. Researcher Vini Barbosa traced the activity to a DONATE message that overwrote earlier state, causing MAYAChain to misclassify legitimate transfers as missing. This misclassification triggered a theft‑detection subsidy that calculated a value of about 49.45 million CACAO while the reserve held only around 168,000 CACAO. Because the pool state was already committed, the subsidy remained recorded even after the transfer failed.

The attacker added a minimal amount of liquidity to the distorted pool and received about 99.93% of its ownership units, resulting in a withdrawal of roughly 48.87 million CACAO. The CACAO token price fell from approximately $0.115 to $0.013, an 88.7% decline, further reducing the measured value of pool inventories.

MayaChain operates as a cross‑chain liquidity network where users trade against pooled assets, and CACAO links those markets. The accounting failure altered pool ownership and pricing, creating a multiplier effect that spread the impact through the network. A diagram illustrating the 23‑message transaction, false theft signal, CACAO repricing, and the estimated $11 million impact was included in the original report.

Full recovery is expected to involve returning or replacing the extracted hard assets, repairing pool balances, and defining how remaining losses are allocated among liquidity providers and other participants. As of now, Maya has not disclosed how these steps will be implemented.