Leaderboard
533All-time rank
Maya Protocol logo

Maya Protocol

Aug 18, 2026

$1.7M
Lost
$1.7M
Recovered
$0
Net loss
$1.7M
Unrecovered0% recovered

45M CACAO that was never actually transferred into the pool. Multiple messages sharing one native transaction ID caused the final DONATE message to overwrite outbound tracking state, making legitimate LINK outbounds appear missing.

MayaChain consequently treated them as unauthorized vault outbounds and invoked slashing. During the resulting subsidy calculation, pool state was updated with an uncapped CACAO credit before the corresponding Reserve-to-Asgard transfer was attempted.

That transfer failed because the Reserve lacked sufficient CACAO, but the inflated pool state was not rolled back. 87M CACAO from Asgard liquidity.

Target
Bridge
Classification
Protocol Logic
Technique
Withdrawal Logic Flaw
Attribution
Unknown
Chains
Mayachain

Event timeline

  1. Aug 18, 2026
    Exploit executed — $1.7M drained via withdrawal logic flaw
  2. Attributed to Unknown
  3. Recovery status Unrecovered 0%

Data credits

Related incidents