Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol
The suspected Bitcoin tackle on the middle of Maya Protocol’s Aug. 18 exploit still held about 20.8273 BTC with no outgoing spend on Aug. 21, whereas no revealed restoration plan accounted for the a lot bigger estimated affect throughout the cross-chain liquidity protocol’s pools.
Public Bitcoin data confirmed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none ready within the mempool. Ten preliminary deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, whereas a later 546-satoshi transaction raised the whole barely. At in the present day’s Bitcoin price, the stability was value about $1.59 million.
Maya Protocol founder Aaluxx initially stated the community had doubtless misplaced about 20 BTC, value roughly $1.4 million on the time, plus about $300,000 in different property. He said he would work to fix the incident and recover in full.
Why changing 20 BTC wouldn’t make pools entire
A technical reconstruction by SigIntZero attributed the exploit to 6 accounting and state-handling flaws chained inside one 23-message transaction. It stated overwritten outbound state produced a false missing-transfer sign, activating a compensation path that credited about 49.45 million CACAO to a skinny ARB.LINK pool regardless that Maya’s reserve held solely about 168,000 CACAO.
The reserve switch failed, however the inflated stability persevered. After including negligible liquidity, the attacker acquired about 99.93% of the pool’s possession models and withdrew roughly 48.87 million CACAO earlier than swapping into property held by different MAYAChain pools.
SigIntZero estimated that about $1.36 million in property moved to exterior chains and roughly $291,000 remained on MAYAChain, placing whole attacker-controlled worth close to $1.65 million to $1.7 million.
Separately, the pool was impacted by $10.9 million. CryptoSlate evaluation attributed about $6.4 million to CACAO repricing and about $2.9 million to arbitrage after the token fell from roughly $0.115 to $0.013, an 88.7% decline.
Maya reportedly hopes for a bug-bounty return and, failing that, might search to exchange roughly 20 BTC via Aztec Chain investments and different means. Even if that Bitcoin is returned or changed, it might cowl just one a part of the injury. As of press time, Maya had not publicly outlined which remaining losses it might restore or who would soak up the hole created by CACAO’s repricing and trades throughout the dislocation.
The put up Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol appeared first on CryptoSlate.
