Maya Protocol Suffers $1.7 Million Loss in Complex Exploit

DeFi Hacks Continue to Surge in 2026: A Closer Look at Recent Incidents

Maya Protocol Loses $1.7 Million in Latest Hack

In a shocking turn of events, the decentralized liquidity protocol Maya Protocol has come to a standstill after an attacker exploited a series of six chained bugs, resulting in a staggering loss of approximately $1.7 million. The pseudonymous co-founder, Aaluxx, revealed the extent of the damage, which has sent ripples through the crypto community.

The native token, CACAO, plummeted by 88% as the attacker swiftly converted the stolen assets into Bitcoin (BTC), Ethereum (ETH), and other cryptocurrencies across all Maya liquidity pools. The attack was executed through a single transaction that cleverly bundled 23 separate instructions, deceiving the network into believing a theft had occurred.

In a desperate attempt to rectify the situation, the protocol tried to compensate for what it thought was a robbery. However, the payout mechanism had no upper limit, leading to an astonishing credit of nearly 49 million CACAO to a pool that was nearly empty. With only 168,000 CACAO in reserve, the transfer failed, leaving the inflated balance on the books.

The attacker then deposited a mere 100 CACAO into the pool, claimed 99.93% ownership, and withdrew an eye-watering 48.87 million CACAO—almost half of the token’s total supply. Following the incident, CACAO’s value plummeted from $0.115 to $0.013 before making a slight recovery to around $0.032. The attacker managed to funnel 20.83 BTC, valued at approximately $1.34 million, to a single Bitcoin address across about ten blocks.

In a bid to regain control, Aaluxx announced a global halt of the project on Discord, appealing to the attacker to return the stolen funds.

DeFi Hacks Keep Stacking Up in 2026

The incident at Maya Protocol is not an isolated case. According to DefiLlama, there have been 219 hacks logged in 2026 alone, amounting to a staggering $1.26 billion in losses. In contrast, the entirety of 2025 saw 146 incidents, with a total loss of $2.71 billion. August has already recorded 16 separate hacking incidents, highlighting the growing vulnerabilities in decentralized finance (DeFi) protocols.

Notably, THORChain, the protocol from which Maya forked, suffered a loss of $10.7 million earlier this year. The recovery of funds now hinges on whether the attacker will accept the bounty offer made by the Maya team. Aaluxx also indicated plans to reach out to arbitrage traders who may have absorbed the pool’s value.

As the crypto community watches closely, the future of Maya Protocol hangs in the balance, with hopes that the stolen funds may still be recovered.