A cross-chain liquidity protocol lost most of its value in a single afternoon on August 18, 2026. Maya Protocol, a THORChain fork that routes swaps between Bitcoin, Ethereum, Arbitrum and its own MAYAChain, watched an attacker chain together six separate software bugs to fabricate 48.87 million CACAO tokens out of thin air, drain roughly $1.7 million in real assets, and trigger an 88.7% collapse in its native token. The direct theft was modest by 2026’s standards. The knock-on damage wasn’t: pool value across the protocol fell by an estimated $10.9 million, effectively erasing Maya’s entire total value locked in a matter of hours.

The exploit lands in the middle of a brutal year for cross-chain infrastructure. It follows the Coreum-XRP bridge hack earlier this month, the Coinsbuy exchange breach, and a summer that CoinGecko’s own tracker put at $1.2 billion in losses across 164 incidents even before this attack landed. What makes Maya’s case worth a closer look isn’t the dollar figure, it’s the mechanism: no stolen keys, no re-entrancy, no oracle manipulation. Just six logic errors in accounting code, chained together in a single 23-message transaction.

What happened to Maya Protocol on August 18

At approximately 17:30 UTC on August 18, 2026, an attacker submitted a single complex deposit transaction to MAYAChain mainnet. That one transaction carried 23 separate messages, and it was enough to trigger a cascade the Maya team later described, in its own post-mortem, as a six-bug chain running through the protocol’s trade account and outbound transaction handling logic. Protocol founder AaluxxMyth confirmed the exploit publicly within hours, and blockchain security firm CertiK flagged the stolen assets as they moved across chains, according to CryptoBriefing’s reporting.

The target was a low-liquidity pool, the kind of thin market that’s cheap to manipulate if you can find the right lever. The attacker found one. Maya’s system failed to correctly recognize that certain withdrawals had already been executed, and that failure mistakenly triggered a “theft detection” mechanism paired with an uncapped slash subsidy meant to compensate the pool for a loss that never actually happened. The result: the protocol credited the pool with nearly 49 million CACAO it didn’t have.

From there the math did the rest of the work. The attacker deposited just 100 real CACAO tokens into the now-inflated pool. Because the pool’s apparent balance had ballooned to tens of millions of tokens, that tiny real deposit was enough to claim 99.93% ownership. The attacker then withdrew 48.87 million CACAO, close to half of the token’s entire 100 million supply, drawn straight from protocol reserves and other liquidity providers’ capital rather than anything the attacker had actually put in.

How the six-bug chain actually worked

Security researchers who reviewed the incident describe it less as a single vulnerability and more as six unlocked doors that happened to line up in exactly the right sequence. Cross-chain protocols like Maya are structurally harder to secure than single-chain DeFi apps because they have to track balances, verify inbound transactions, and reconcile state across multiple independent blockchains at once. Every one of those reconciliation points is a place where an assumption can be wrong.

In this case, the failure sat in outbound-transaction bookkeeping. The system mis-tracked whether a withdrawal had cleared, misfired a compensation mechanism designed for a different failure mode entirely, and then applied that compensation without a cap. None of the six bugs on its own would have been catastrophic. Chained together in one transaction, they let an attacker mint value that didn’t exist and cash it out before anyone could react.

Once the attacker held the inflated pool position, extraction was straightforward. Stolen value moved out as roughly 20.83 BTC plus assorted CACAO and LINK, swapped across Bitcoin, Ethereum and Arbitrum to external wallets. Analysts at blockchain research firm Defimon put the confirmed off-chain extraction at $1,356,218, with total attacker-controlled value, including tokens still sitting on-chain, reaching close to $1.7 million. Security incident tracker SlowMist Hacked logged the event within its public bridge-exploit database the same week.

CACAO’s price crash, by the numbers

The token damage was disproportionate to the theft. CACAO traded around $0.115 before the exploit. Within hours it bottomed near $0.013, a drop of roughly 88.7%. As of this writing the token has clawed back to somewhere in the $0.03 range, which still leaves it down about 74% from its pre-exploit level. For a protocol whose total value locked sat at roughly $10 million before the attack, a pool value decline near $10.9 million effectively wiped the whole thing out once cascading price effects on CACAO-denominated positions are factored in.

MetricPre-exploitPost-exploit (low)Change
CACAO price$0.115$0.013-88.7%
CACAO price (recovered, Aug 20)—~$0.032-72% to -74% vs. pre-exploit
CACAO in circulation drained100M total supply48.87M removed~48.9% of supply
Total pool value~$10M TVL—-$10.9M pool value decline
Direct assets stolen—~$1.7M (incl. 20.83 BTC, LINK, CACAO)—
Confirmed off-chain extraction—$1,356,218—

That last row matters for anyone trying to understand DeFi exploit accounting. The headline “$1.7 million hack” understates the real damage by a factor of roughly six once you count the collateral price destruction. It’s a pattern that shows up again and again in cross-chain incidents: the theft is the trigger, but the panic-driven price collapse and liquidity flight do most of the actual economic harm.

Maya Protocol’s THORChain lineage

Maya Protocol didn’t build its cross-chain liquidity architecture from scratch. It’s a fork of THORChain, inheriting the same basic design: a native chain that settles swaps between otherwise incompatible blockchains, backed by a native token (RUNE for THORChain, CACAO for Maya) that absorbs price risk on both sides of every trade. That architecture has always carried elevated risk relative to single-chain AMMs, because it requires the protocol to independently verify state across networks that don’t talk to each other natively.

Forking a codebase inherits its design assumptions, not necessarily its bugs. Maya’s team says the specific six-bug chain that got exploited on August 18 was distinct to MAYAChain’s own slash-subsidy and accounting logic rather than a straight repeat of a previously disclosed THORChain issue. But the underlying lesson is the same one the THORChain ecosystem has learned the hard way multiple times: complex, stateful cross-chain accounting is exceptionally difficult to get fully correct, and even a mature, forked codebase can carry a latent flaw for years before someone finds the right sequence to trigger it.

Where this fits in 2026’s DeFi exploit trend

Maya’s hack wasn’t an isolated event. According to CoinGecko’s running tally of crypto hacks and exploits, 2026 had already logged roughly $1.2 billion in losses across 164 incidents before this attack, against $2.55 billion across 97 incidents for all of 2025 (KuCoin flash news). That comparison tells its own story: 2026 has more individual incidents but a lower average payout per hack, a shift toward smaller, more frequent exploits rather than the mega-hacks that defined 2021-2022.

One financial outlet’s tracker called Maya the 16th publicly logged crypto hack of August 2026 alone. That’s not a typo-level anomaly, it’s close to one incident every two days for the month. Earlier in the month, the tx (formerly Coreum) bridge connecting XRP Ledger lost roughly 199,900 XRP, worth around $200,000, to a deposit-verification flaw with clear structural similarities to Maya’s: an off-chain relayer or accounting layer accepted something it shouldn’t have as proof of a legitimate deposit. Around the same window, Coinsbuy lost more than $8 million in a coordinated attack across TRON and Ethereum wallets, and Wanchain’s Cardano-BNB Chain bridge lost roughly $13 million, about 97% of that bridge’s reserves.

IncidentDateAmount lostRoot cause
Maya Protocol (MAYAChain)Aug 18, 2026~$1.7M direct / ~$10.9M pool valueSix-bug accounting/slash-subsidy chain
Coreum-XRP (tx) bridgeAug 9, 2026~$200,000 (199,900 XRP)Deposit-verification logic flaw
Coinsbuy exchangeAug 9, 2026$8M+Coordinated cross-chain wallet attack
Wanchain (Cardano-BNB bridge)Jul 31, 2026~$13M (97% of reserves)Bridge validator/reserve drain
Ronin Bridge (historical)Mar 2022~$625MValidator key compromise
Wormhole (historical)Feb 2022~$320MSignature verification bug
Nomad Bridge (historical)Aug 2022~$190MImproper message verification
Euler Finance (historical)Mar 2023~$197M (largely recovered)Flash-loan/donation attack

Set against that table, Maya’s raw dollar loss looks minor. Ronin lost 368 times more. Wormhole lost 188 times more. But scaled to Maya’s own size, the damage is proportionally worse than any of those historical mega-hacks: it wiped out an estimated 100%-plus of the protocol’s total value locked in a single day. Smaller protocols with thinner liquidity and less battle-tested code are, mathematically, one bad transaction away from a near-total loss event, even when the attacker’s absolute take is small enough to barely register against 2026’s billion-dollar-plus running total.

Recovery plan, chain status and the white-hat offer

Maya’s team halted MAYAChain within hours of detecting the exploit, pausing BTC swaps and broader cross-chain operations to stop further drainage. As of August 21, the network remains in a halted or maintenance state while the team works through fixes for all six identified bugs across theft/slash detection, pool accounting and outbound transaction handling.

The team has extended a white-hat bounty offer to the attacker, a standard move in DeFi incident response: return the bulk of the funds, keep an agreed percentage as a bounty, avoid prosecution. Forklog’s coverage notes it has worked before. Euler Finance recovered roughly $197 million through a comparable negotiated return in 2023. It doesn’t always work; plenty of attackers simply ignore the offer and cash out. The attacker in this case still held roughly 8.87 million CACAO on-chain after the initial swaps, worth around $288,000 at depressed post-crash prices, giving the team at least a theoretical lever if governance or on-chain mechanisms allow any of it to be frozen or clawed back.

Beyond the bounty offer, Maya is reportedly exploring asset replenishment through its Aztec Chain integration as one path to compensate affected liquidity providers, though no finalized reimbursement scheme has been publicly confirmed as of this writing. A third-party security audit from a recognized firm is widely expected to be a prerequisite before meaningful capital returns to the protocol’s pools.

Market and industry impact

The immediate market impact was contained mostly to CACAO and Maya’s own liquidity providers rather than spilling into the broader crypto market. XRP itself, notably, was untouched by the earlier Coreum incident and this one is even further removed from XRP Ledger’s core protocol; commentary around both incidents has stressed that assets held in standard non-custodial wallets or through regulated products are unaffected by bridge-layer or app-layer bugs like these.

The bigger impact is reputational, and it lands on a category of DeFi protocol that was already under scrutiny. Cross-chain bridges and multi-chain liquidity protocols have consistently ranked among the most frequently exploited categories in crypto going back to 2021. Every new incident, even a comparatively small one like Maya’s, pushes capital allocation decisions further toward protocols with longer track records, multiple completed third-party audits, and conservative accounting designs. For newer interoperability projects trying to bootstrap liquidity, the credibility bar just got higher, and it was already high.

There’s also a structural point worth making about incident frequency versus incident size. A protocol logging 16 hacks in a single month, even when most are individually small, signals something about the overall maturity of DeFi security tooling relative to the pace of new protocol launches. Formal verification, invariant testing and bug bounty programs have all matured significantly since the 2021-2022 mega-hack era, yet 2026’s incident count keeps climbing even as average severity trends down. That’s arguably progress, not failure, but it’s slow progress against a fast-growing attack surface.

Competitive comparison: how cross-chain protocols stack up on incident history

Not every cross-chain liquidity protocol carries the same risk profile, and Maya’s incident is a useful prompt to compare how different designs have fared. THORChain, the protocol Maya forked, has itself weathered multiple exploits and network pauses over its history, reflecting the same class of stateful cross-chain accounting risk. LayerZero-based bridges and Wormhole’s guardian-network model represent a different trust assumption, relying on a set of external validators rather than native chain-level accounting, which trades one set of risks (validator collusion or key compromise, as in Ronin and Wormhole) for another (accounting logic bugs, as in Maya and the Coreum-XRP bridge).

Neither model has proven categorically safer in practice. What the data does show is that protocol age and audit depth correlate more strongly with incident severity than the specific bridging architecture chosen. Newer protocols, regardless of design philosophy, get hit harder relative to their size because they haven’t yet accumulated the years of adversarial testing that catches subtle accounting edge cases like the slash-subsidy overflow that hit Maya.

Historical context: a decade of bridge and DeFi hacks

Cross-chain infrastructure has been crypto’s most consistently exploited category since bridges became load-bearing infrastructure around 2021. Poly Network lost roughly $610 million in August 2021 to an interoperability bug, though most of it was returned by the attacker. Ronin’s validator compromise in March 2022 cost Axie Infinity’s ecosystem $625 million. Wormhole lost $320 million the same month to a signature verification flaw. Nomad lost $190 million in August 2022 to improper message verification that let essentially anyone replay a validated transaction. Mango Markets lost $114 million in October 2022 to an oracle and governance manipulation attack.

Maya’s $1.7 million direct loss is a rounding error against any of those figures. What it shares with all of them is the underlying failure category: complex, multi-party or multi-chain state reconciliation that’s exceptionally hard to reason about exhaustively, even for experienced teams. Every one of the historical incidents above was, in hindsight, an obvious-looking flaw once explained. None of them were obvious beforehand, including this one.

What developers and protocols should take from this

The Maya incident offers a fairly specific engineering lesson: any compensation or subsidy mechanism designed to fix a detected error needs a hard cap, full stop. An uncapped “make the pool whole” function is a mint function with extra steps, and it will eventually be triggered by a state it wasn’t designed to handle. That’s true whether the mechanism is called a slash subsidy, an insurance fund payout, or a rebase adjustment.

It also reinforces a point security researchers have been making about cross-chain protocols specifically: the attack surface isn’t just the smart contract code that gets audited, it’s the off-chain relayer and verification logic that decides what counts as a legitimate deposit or withdrawal in the first place. Both Maya’s slash-subsidy bug and the earlier Coreum-XRP deposit-verification flaw sit in that same category, off-chain or semi-off-chain logic that doesn’t always get the same audit scrutiny as on-chain contract code, despite controlling equally consequential value flows.

Predictions: where this goes next

  • Maya Protocol will almost certainly commission a full third-party audit before relaunching MAYAChain at scale, following the pattern set by other post-exploit protocols; expect that process to take several weeks to a few months.
  • The white-hat offer has roughly even odds of partial success based on 2023-2026 precedent; a full return is unlikely given the attacker still controls a meaningful CACAO position at depressed prices.
  • CACAO is unlikely to fully recover to its pre-exploit price in the near term, given the trust damage layered on top of the direct supply dilution.
  • Expect at least one more mid-sized (sub-$20 million) cross-chain or bridge exploit before the end of Q3 2026, continuing 2026’s pattern of frequent, smaller incidents rather than single mega-hacks.
  • Regulatory and industry pressure toward mandatory capped-compensation and formal-verification standards for cross-chain accounting logic will grow, though binding requirements remain unlikely before 2027.

Frequently asked questions

What is Maya Protocol?
Maya Protocol is a cross-chain liquidity platform and a fork of THORChain. It settles swaps between Bitcoin, Ethereum, Arbitrum and other chains using its own MAYAChain and native CACAO token as the settlement asset.

How much was stolen in the Maya Protocol hack?
The attacker’s direct, confirmed take was roughly $1.7 million, including about 20.83 BTC plus CACAO and LINK tokens. Total pool value across the protocol fell by an estimated $10.9 million once the CACAO price crash and liquidity flight are counted.

Was the XRP Ledger or Bitcoin network itself compromised?
No. The exploit was confined to MAYAChain’s own accounting logic. Neither Bitcoin’s protocol nor any user’s private keys held in standard wallets were affected.

How did the attacker create fake CACAO tokens?
By exploiting a chain of six bugs in a single transaction: a mistracked withdrawal triggered a “theft detection” mechanism, which fired an uncapped slash-subsidy compensation, crediting a pool with nearly 49 million CACAO tokens it never actually held.

Is Maya Protocol still operating?
MAYAChain remains halted as of August 21, 2026, with BTC swaps and other cross-chain operations paused while the team patches all six identified vulnerabilities and pursues recovery options, including a white-hat bounty offer to the attacker.

How does this compare to other 2026 crypto hacks?
It’s one of at least 16 publicly logged crypto hacks in August 2026 alone, part of a year that had already reached roughly $1.2 billion in losses across 164 incidents even before this exploit, according to CoinGecko’s tracker.

Will affected liquidity providers be reimbursed?
No finalized reimbursement plan has been confirmed publicly. The team has discussed potential asset replenishment through its Aztec Chain integration, but as of this writing that remains unconfirmed.

What should users of cross-chain DeFi protocols do now?
Treat multi-chain liquidity protocols, especially newer or less-audited ones, as higher risk than single-chain DeFi. Diversify exposure, favor protocols with multiple completed independent audits, and avoid concentrating capital in low-liquidity pools that are cheaper for an attacker to manipulate.