MAYAChain's 20 BTC Heist: $11 Million Fallout and CACAO Collapse

MAYAProtocol’s latest vulnerability turned a cross‑chain liquidity platform into a 1.7 million‑dollar bitcoin drain, shaking the confidence in decentralized finance.

Exploit Mechanics

MAYAChain’s code mistakenly treated a missing outbound transaction as a failure, triggering a compensation that added 49 million CACAO to a liquidity pool. The platform’s actual reserve was only 168,000 CACAO, so the payment failed, yet the new balance was permanently recorded. This allowed an attacker to gain >99% of the pool with a minuscule deposit.

Financial Fallout

The attacker withdrew 20.83 BTC, worth about $1.34 million, and retained 8.87 million CACAO, which was swapped for $1.36 million on external blockchains. Total impact:

■$1.65 million directly stolen

■$6.4 million from CACAO devaluation

■$2.9 million from arbitrage gains

CACAO’s Collapse

Post‑exploit, CACAO fell from $0.115 to $0.013, an 89% drop, dragging pool values down by $10.9 million.

Market Reaction

Arbitrageurs turned the cheap CACAO into BTC, ETH, and stablecoins, further depleting liquidity. The platform halted all trades, announcing a full fix and a potential bug‑bounty reward for the attacker’s return.

Recovery Pathways

MAYAChain is waiting for the attacker to return funds in exchange for a bounty. It also plans to replace the lost 20 BTC through investments in Aztec Chain and other means. CACAO’s recovery, however, remains slow and uncertain.

Markets face increasing sensitivity to such technical failures. Low‑reserve pools and faulty compensation mechanisms expose liquidity providers to significant risk. This incident underscores the need for stricter security standards in DeFi.