Maya Protocol shut down its network on August 18 after an attacker exploited a sequence of six bugs to drain $1.7 million from the decentralized exchange, including 20.83 BTC moved to external blockchains.
The DEX halted operations immediately upon discovery of the exploit. The attacker chained vulnerabilities together rather than triggering a single flaw, a technique that compounds damage across interconnected smart contract functions.
Maya Protocol is a cross-chain liquidity protocol built on the THORChain consensus layer, designed to facilitate swaps between different blockchains without wrapped tokens. The $1.7 million extracted represents a material loss for a mid-tier DEX but falls below the scale of major protocol hacks in 2024 and 2025, when Curve, Lido and other platforms each lost tens of millions.
The extraction of bitcoin to external chains indicates the attacker moved the stolen assets off Maya's network immediately, a standard step to prevent recovery or freeze. The precise figure of 20.83 BTC, worth roughly $900,000 at the time of the incident, accounts for the bitcoin portion of the total loss.
Six distinct bugs in sequence allowed a single attacker to drain funds without needing multiple entry points or accomplices. Chained vulnerabilities are rarer than single-vector exploits and require either a sophisticated audit bypass or accumulation of unrelated flaws that happened to align exploitably.
Maya Protocol has not yet disclosed whether funds are recoverable, whether insurance covers the loss, or a timeline for network restart. The team did not publish a detailed post-mortem at the time of the halt.
