Trading halted after suspected vulnerability attack
On Aug. 19, BlockBeats reported that MAYAChain founder AaluxxMyth said the Cosmos-based, THORChain-like decentralized cross-chain trading protocol appears to have suffered a vulnerability attack. The team has imposed a global pause and said the loss has been brought under control while it works to fix the flaw and restore trading.
According to AaluxxMyth, the attacker removed about 20 BTC, worth roughly $1.4 million, along with about $300,000 in other assets during the past hour.
Attack used multiple chain-level flaws
He said the attacker exploited six chain-linked flaws in MAYAChain Trade Account and the outbound processing flow, building a MsgDeposit transaction with 23 messages. That transaction triggered an incorrect "theft detection" response. The attacker then used an uncapped penalty-subsidy mechanism to inject a large amount of CACAO into a low-liquidity pool before extracting funds through add-liquidity and withdrawal actions.
The attack drained about 48.87 million CACAO from the Asgard module. The attacker has already moved 20.83 BTC to the Bitcoin address bc1q0hsgwu...y5l646 and still holds about 8.87 million CACAO.
CACAO briefly fell 88.7%
After the attack, CACAO fell from about $0.115 to as low as $0.013, a drop of roughly 88.7%, before recovering somewhat.
AaluxxMyth said the team will try to restore the damaged liquidity by recovering the stolen funds, working with arbitrageurs and using other methods. He added that if 20 BTC can be re-injected into the pool, CACAO may return to around $0.115. The team is still investigating the incident and will continue to share updates.