Loading story…
Maya Protocol, also known as MAYAChain, halted its network after an attacker chained six bugs to manipulate pool accounting and drain about $1.7 million in shared liquidity. Investigators said the exploit began when an outbound transaction was incorrectly treated as missing, triggering a compensation routine that falsely credited roughly 49 million CACAO to a pool that held only about 168,000 CACAO in reserves. Because the failed transfer was not properly rolled back, the attacker could add a small amount of liquidity, dominate the inflated pool, and withdraw about 48.87 million CACAO along with roughly 98.82 LINK before swapping assets into BTC, ETH, and other tokens.
The incident caused damage beyond the direct theft, with reports that liquidity pool value fell by roughly $10.9 million to $11 million overall and the CACAO token price plunged nearly 89% before partially recovering. Maya Protocol said trading was fully stopped to contain the attack, while project representatives said they would work to fix the flaw, recover funds, and reimburse the stolen 20 BTC if the attacker does not return assets under a possible bug bounty arrangement. Public statements from the team also pointed to treasury resources, including funds invested in Aztec Chain, as a potential source for reimbursement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Maya Protocol's team said it would work to fix the vulnerability and recover funds in full. The team also said it hoped the attacker might return the assets via a bug bounty arrangement and intended to reimburse the stolen 20 BTC from invested funds and other sources if needed.
After the exploit, Maya Protocol activated a global halt and fully stopped trading on MAYAChain to limit further damage. LeoDex reported the halt, and founder Aaluxx/AaluxxMyth confirmed the incident and response.
An attacker exploited Maya Protocol/MAYAChain using a chain of six bugs that falsely inflated pool accounting and enabled the theft of roughly $1.7 million in assets. Reported stolen amounts included about 48.87 million CACAO, 98.82 LINK, and roughly 20 BTC plus other assets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers exploited a vulnerability in the Balancer DeFi protocol's V2 pools, resulting in the theft of over $120 million in cryptocurrency, with at least $99 million stolen in ETH. The attack targeted Balancer's Compostable Stable Pools and was traced to either a precision rounding error in the Vault’s swap calculations or faulty access control mechanisms, allowing the attacker to manipulate token swaps and balances. Balancer confirmed that the exploit did not impact its V3 pools and has paused affected pools while working with security researchers to investigate the incident. The company has warned users to be vigilant against phishing attempts and fraudulent messages purporting to be from its security team. Several other blockchain organizations connected to Balancer, such as the Berachain Foundation, Gnosis, Sonic, and Beefy, took emergency measures to protect user assets, including halting networks and freezing stolen funds where possible. Despite Balancer's history of multiple security audits and bug bounty programs, this incident highlights ongoing risks in DeFi protocols. A full post-mortem is expected once the investigation concludes.
Jun 29, 2026
Cork Protocol suffered a smart contract exploit that allowed an attacker to withdraw about **$12 million** from the DeFi platform. Multiple reports said the protocol halted activity and suspended affected smart contracts after the breach, as the team moved to contain the incident and assess losses. Follow-up reporting said Cork Protocol began recovery efforts and planned to redeploy its market infrastructure after the hack. Coverage of the incident consistently identified the breach as a smart contract exploit, with the attacker extracting funds before protocol operations were paused and remediation work began.
Jul 12, 2026
Check Point Research reported that an attacker drained **$128 million** from the Balancer decentralized finance platform by exploiting a **rounding error** in the protocol’s calculations. The incident shows how small arithmetic flaws in smart-contract logic can be weaponized to manipulate pool balances and extract large amounts of value from DeFi systems. The reported attack focused on a weakness in how Balancer handled numerical precision, allowing the attacker to repeatedly benefit from favorable rounding behavior until funds were siphoned from the platform. The case highlights the security impact of precision and accounting bugs in blockchain applications, where seemingly minor implementation errors can escalate into major financial losses.
Jul 12, 2026