Maya Protocol, a cross-chain trading network, suffered an exploit that drained bitcoin and other digital assets from its liquidity pools, sending the network's total pool value tumbling by roughly $11 million.
## How the Attack Unfolded The breach stemmed from a chain of six distinct flaws in the protocol's code, according to the network. The vulnerabilities combined to let the system credit a pool with nearly 50 million tokens that were never actually backed by deposited funds.
Once that phantom balance appeared on the books, the attacker was able to leverage it to withdraw genuine assets held by the protocol, including bitcoin. The result was a real loss of liquidity for the platform, even though the tokens that triggered the exploit were never legitimately funded.
A cascade of six code flaws let an attacker conjure tens of millions in tokens out of thin air, then cash them out for real crypto.
## Impact on the Protocol Cross-chain networks like Maya are designed to let users swap assets across different blockchains, relying on pools of liquidity to facilitate those trades. When a pool is drained, it undermines the trust and functionality that keep such platforms operating.
The incident highlights the persistent security challenges facing decentralized finance, where interconnected smart contracts can create hidden points of failure. A single logic error, when combined with others, can open the door to significant losses.
Key takeaways from the incident include:
- Six chained vulnerabilities enabled the exploit
- Nearly 50 million unfunded tokens were credited to a pool
- Pool value fell by about $11 million as real assets were drained
The event adds to a growing list of cross-chain and DeFi exploits that have cost the sector heavily, underscoring the importance of rigorous code audits and layered security defenses for protocols handling user funds.