A 23-Message Transaction Just Turned $1.36M Into $11M of Damage on MAYAChain
One exploit. Twenty-three messages. Nearly $11 million in pool damage, and a native token that collapsed 88.7% before most traders even knew what hit them.
MAYAChain, the cross-chain liquidity protocol often pitched as a THORChain alternative, confirmed a critical exploit this week that started with $1.36 million in direct theft but spiraled into a pool-level catastrophe that is still being reconciled. The gap between those two numbers is the part nobody is talking about.
How 23 Messages Broke Everything
The attacker didn't brute-force their way in. They sent a single, carefully constructed transaction containing 23 messages that corrupted MAYAChain's internal pool accounting. Think of it as slipping a forged ledger entry into the vault's own bookkeeping system. The protocol didn't flag it. The pools didn't flag it. By the time the damage was visible on-chain, the accounting was already poisoned.
Once pool accounting broke, CACAO, MAYAChain's native token, entered freefall. The token dropped 88.7% as liquidity providers and traders processed what the corrupted state meant for their positions. That price collapse is what turned a $1.36 million direct exploit into nearly $11 million in total pool damage. The theft was the spark. The CACAO crash was the fire.
The Recovery Problem Nobody Has Solved Yet
MAYAChain's team has put a recovery plan on the table, but the math is genuinely difficult. When pool accounting is corrupted and the native token loses nearly 90% of its value in the same window, any recovery mechanism denominated in CACAO faces a moving target. Liquidity providers who were in the pools during the event are sitting on losses that a token-denominated reimbursement plan may not actually make whole, depending on when and how CACAO reprices.
This isn't MAYAChain's first stress test, but it is the most expensive one. Cross-chain liquidity protocols carry a specific attack surface that single-chain DeFi platforms don't: the complexity of routing logic across multiple chains creates accounting edge cases that sophisticated attackers actively hunt for. THORChain learned this the hard way in 2021. MAYAChain is learning it now.
What to Watch
If you hold CACAO or have liquidity positions in MAYAChain pools, the immediate priority is understanding whether the recovery plan covers your specific entry point and denomination. Watch for an official snapshot date, which will determine who qualifies for reimbursement and at what valuation.
More broadly, any cross-chain protocol in your portfolio deserves a second look at its transaction validation architecture. The 23-message attack vector is now documented. Copycats move fast in DeFi.