The suspected Bitcoin tackle on the middle of Maya Protocol’s Aug. 18 exploit nonetheless held about 20.8273 BTC with no outgoing spend on Aug. 21, whereas no revealed restoration plan accounted for the a lot bigger estimated impression throughout the cross-chain liquidity protocol’s swimming pools.
Public Bitcoin information confirmed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none ready within the mempool. Ten preliminary deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, whereas a later 546-satoshi transaction raised the full barely. At right now’s Bitcoin value, the stability was price about $1.59 million.
Maya Protocol founder Aaluxx initially mentioned the community had possible misplaced about 20 BTC, price roughly $1.4 million on the time, plus about $300,000 in different property. He mentioned he would work to repair the incident and get well in full.
Why changing 20 BTC wouldn’t make swimming pools complete
A technical reconstruction by SigIntZero attributed the exploit to 6 accounting and state-handling flaws chained inside one 23-message transaction. It mentioned overwritten outbound state produced a false missing-transfer sign, activating a compensation path that credited about 49.45 million CACAO to a skinny ARB.LINK pool despite the fact that Maya’s reserve held solely about 168,000 CACAO.
The reserve switch failed, however the inflated stability persevered. After including negligible liquidity, the attacker obtained about 99.93% of the pool’s possession models and withdrew roughly 48.87 million CACAO earlier than swapping into property held by different MAYAChain swimming pools.
SigIntZero estimated that about $1.36 million in property moved to exterior chains and roughly $291,000 remained on MAYAChain, placing whole attacker-controlled worth close to $1.65 million to $1.7 million.
Individually, the pool was impacted by $10.9 million. mycryptopot evaluation attributed about $6.4 million to CACAO repricing and about $2.9 million to arbitrage after the token fell from roughly $0.115 to $0.013, an 88.7% decline.
Maya reportedly hopes for a bug-bounty return and, failing that, might search to exchange roughly 20 BTC by way of Aztec Chain investments and different means. Even when that Bitcoin is returned or changed, it might cowl just one a part of the harm. As of press time, Maya had not publicly outlined which remaining losses it might restore or who would soak up the hole created by CACAO’s repricing and trades throughout the dislocation.
