Cross-chain liquidity protocol Maya Protocol has been exploited for approximately $1.7 million, marking the first significant loss-of-funds incident for the THORChain fork since its mainnet went live in April 2023.
Blockchain security firm PeckShield flagged the incident through its alert channels, reporting that roughly $1.7 million worth of crypto had been drained from the protocol’s vault infrastructure. The disclosure was followed by an on-chain acknowledgement from Maya co-founder Aaluxx, who confirmed the breach and outlined the team’s immediate response.
Maya Protocol operates as a friendly fork of THORChain, using the Cosmos-SDK, Tendermint consensus, and GG20 Threshold Signature Scheme to manage native cross-chain swaps without wrapping or bridging assets. The protocol’s roughly 38 active validators jointly custody user funds in Asgard and Yggdrasil vaults across supported chains including Bitcoin, Ethereum, Dash, Zcash, RUNE, and Arbitrum. Total value locked on the protocol had been hovering around the $15 million mark heading into the incident, per DeFiLlama figures.
On-chain footprint of the drain
The attacker moved funds out of Maya’s externally-held vaults before the protocol’s automated solvency checker and node-level halt mechanisms could fully contain the outflow. Under Maya’s security design, chain-specific trading is meant to auto-pause once solvency deviates beyond safe thresholds, with individual node operators able to trigger a 720-block (roughly one-hour) HaltTrading window that stacks with additional node calls.
Alert noted the exploiter’s address and the assets involved, though a full transaction-level post-mortem tracing the attack path had not been published at press time. Maya’s chain-halt Mimir flags were activated in the immediate aftermath, freezing further deposits and withdrawals on the affected pools while validators and the development team investigated.
The $1.7 million figure represents just over 10% of Maya’s tracked total value locked (TVL), a significant hit for a protocol whose CACAO token has a circulating market cap of roughly $10 million and trades around $0.10, down more than 92% from its all-time high of $1.43.
Aaluxx confirms breach, points to fix
In his public statement, Aaluxx acknowledged the exploit, thanked node operators for their rapid response, and indicated the team had identified the vulnerability and was preparing a patch.
Maya’s post-incident stance historically mirrors THORChain’s post-2022 approach: halt trading first, audit and patch the code, then resume operations, rather than issue a treasury-funded bailout. Under the protocol’s design, loss events are typically socialised across liquidity providers and bonded nodes per Maya’s economic security model.
Maya’s Immunefi bug bounty program caps critical vulnerability payouts at $35,000, a figure that has drawn attention from security researchers who have flagged Maya’s ETH Router contract as still carrying a “Draft 3” audit label from Halborn as of earlier this year. The inherited Bifrost architecture from THORChain was the same interface exploited in July 2021 for a combined $15 million across two separate incidents.
Second cross-chain hit in months for the THOR ecosystem
The Maya incident lands roughly three months after THORChain itself was drained of approximately $10.8 million on May 15, 2026, in what the team later revised to a $7.4 million loss after one of six Asgard vaults was confirmed compromised. That exploit spanned Bitcoin, Ethereum, BNB Smart Chain, and Base, forced a full trading halt, and pushed RUNE down roughly 15% on the day. THORChain’s planned Monero integration was postponed indefinitely as a result.
The broader picture remains grim for cross-chain infrastructure. PeckShield’s own tallies show eight major bridge and cross-chain exploits drained a combined $328.6 million through mid-May 2026 alone, with cumulative DeFi hack losses for the year clearing $750 million by mid-April on the back of the $292 million Kelp DAO and $285 million Drift Protocol incidents. June added another $75.9 million across 40 separate incidents, led by the $31 million Humanity Protocol breach.
Maya’s incident, while smaller in dollar terms, is structurally notable because the protocol had gone more than three years without a documented loss-of-funds event, a track record its team and community frequently cited as validation of the “halt first” security posture. The full technical breakdown of how the attacker bypassed Maya’s solvency checks, TxOut throttler, and node-level circuit breakers is expected in a post-mortem from the Maya team in the coming days.
Also Read: Hackers Exploit Apple Screen Sharing Flaw to Mine Monero on Macs
