Maya Protocol attacker still holds 20.83 BTC after $11 million liquidity crash
This digest was compiled by AI from multiple sources — links to the originals are below.
The suspected address behind Maya Protocol's Aug. 18 exploit still held 20.8273 BTC with no outgoing spend as of Aug. 21. Maya has not published a final pool ledger, compensation terms, or who will absorb losses from CACAO repricing and arbitrage. SigIntZero estimated about $1.65 million to $1.7 million in attacker-controlled assets and nearly $10.9 million in wider pool impact.
Key Facts
- The suspected Bitcoin address held 20.82731228 BTC with zero spent and 11 confirmed transactions as of Aug. 21.
- SigIntZero estimated total attacker-controlled value at $1.65 million to $1.7 million, with about $1.36 million moved to external chains and roughly $291,000 remaining on MAYAChain.
- The exploit chained six accounting and state-handling flaws in one 23-message transaction, crediting about 49.45 million CACAO to a thin ARB.LINK pool.
- CryptoSlate analysis attributed about $6.4 million of the pool impact to CACAO repricing and about $2.9 million to arbitrage after the token fell 88.7% from $0.115 to $0.013.
- Maya Protocol founder Aaluxx initially said the network likely lost about 20 BTC, worth roughly $1.4 million at the time, plus about $300,000 in other assets.
Attacker Holdings
Public Bitcoin data showed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none waiting in the mempool. Ten initial deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, while a later 546-satoshi transaction raised the total slightly. At today's Bitcoin price, the balance was worth about $1.59 million.
Exploit Mechanics
A technical reconstruction by SigIntZero attributed the exploit to six accounting and state-handling flaws chained inside one 23-message transaction. It said overwritten outbound state produced a false missing-transfer signal, activating a compensation path that credited about 49.45 million CACAO to a thin ARB.LINK pool even though Maya's reserve held only about 168,000 CACAO. The reserve transfer failed, but the inflated balance persisted. After adding negligible liquidity, the attacker received about 99.93% of the pool's ownership units and withdrew roughly 48.87 million CACAO before swapping into assets held by other MAYAChain pools.
Unresolved Losses
Maya reportedly hopes for a bug-bounty return and, failing that, could seek to replace roughly 20 BTC through Aztec Chain investments and other means. Even if that Bitcoin is returned or replaced, it would cover only one part of the damage. As of press time, Maya had not publicly defined which remaining losses it would restore or who would absorb the gap created by CACAO's repricing and trades during the dislocation.
1 source
Maya Protocol attacker still holds 20.83 BTC after $11 million liquidity crash
