Maya Protocol
Hack or exploit on Aug 18, 2026 · Withdrawal Logic Flaw
What happened
A multi-bug interaction in MayaChain’s outbound/slashing and pool-accounting flow caused a staged ARB.LINK pool to be credited with approximately 49.45M CACAO that was never actually transferred into the pool. Multiple messages sharing one native transaction ID caused the final DONATE message to overwrite outbound tracking state, making legitimate LINK outbounds appear missing. MayaChain consequently treated them as unauthorized vault outbounds and invoked slashing. During the resulting subsidy calculation, pool state was updated with an uncapped CACAO credit before the corresponding Reserve-to-Asgard transfer was attempted. That transfer failed because the Reserve lacked sufficient CACAO, but the inflated pool state was not rolled back. The attacker then added liquidity to the effectively asset-empty ARB.LINK pool, obtained nearly all pool ownership, and withdrew approximately 48.87M CACAO from Asgard liquidity
Details
- Date
- Aug 18, 2026
- Kind
- Hack or exploit
- Method
- Withdrawal Logic Flaw
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Mayachain
Related incidents
Sweat Foundation 2026 · Hack or exploit · $3.5M
Allbridge Core 2026 · Hack or exploit · $1.6M
Aftermath Perps 2026 · Hack or exploit · $1.1M
Avici 2026 · Hack or exploit · $501K
SwanBluechip, "Maya Protocol hack, Aug 18, 2026: $1.7M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht152b5b9dfd/ (data as of 2026-10-31).