BlockBeats News, August 19th. AaluxxMyth, the founder of MAYAChain, a decentralized cross-chain trading protocol based on the Cosmos architecture and similar to THORChain, posted a message stating that the protocol had encountered a suspected exploit. In the past hour, the attacker withdrew approximately 20 BTC (worth around $1.4 million) and other assets (about $300,000). The team has implemented a global pause to control the damage and is currently working on fixing the exploit to restore trading functionality.

The attacker exploited a series of 6 chained vulnerabilities in MAYAChain's Trade Account and outbound processing flow. They crafted a single MsgDeposit transaction containing 23 messages, triggering a faulty "slashing detection." Subsequently, they injected a significant amount of CACAO into a low-liquidity pool through an unrestricted slash-and-bond mechanism, and then extracted the funds through liquidity additions and withdrawals.

This attack resulted in approximately 48.87 million CACAO being drained from the Asgard module. The attacker has transferred 20.83 BTC to a Bitcoin address bc1q0hsgwu...y5l646 while holding about 8.87 million CACAO. Following the attack, the price of CACAO plummeted from around $0.115 to a low of $0.013, representing an 88.7% drop, but has since slightly recovered.

AaluxxMyth stated that the team will attempt to recover the attacked funds, collaborate with arbitrageurs, and explore other avenues to restore the affected liquidity. They mentioned that if the 20 BTC can be reintroduced into the pool, the CACAO price could potentially recover to around $0.115. Currently, the team is still investigating the details of the attack and will continue to provide updates on the progress.