Maya's six-bug exploit cost $1.7M and 89% of CACAO. Every bug worked as written.

Two loss figures are in circulation, and both are defensible, which is the uncomfortable part. The attacker left with 48.87 million CACAO and 98.82 LINK ^[4]. At the pre-attack price of $0.115, that CACAO was worth about $5.6 million; at the post-attack price of $0.013, about $635,000 ^[3]. Any single dollar figure for this incident is a decision about which of those two prices counted, taken during an event that moved the price 89% inside 240 blocks ^[2][7].

The mechanism explains why the accounting is that slippery. According to CertiK, the attacker convinced Maya to award a subsidy that did not exist, misstating internal accounting, then added and removed liquidity repeatedly to pull assets out of shared pools ^[3]. No step in that sequence requires a broken line of code. Cryptopolitan's read is that ordinary protocol logic behaved differently than expected, and the six bugs spanned accounting, liquidity and outbound transaction handling ^[1]. DefiLlama filed it under "Protocol Logic" ^[5], which is the honest label and also an admission that the category has no simple detector.

THORChain, which Maya was forked from ^[15], already ran this experiment. Its May incident cost $10.7 million, and the post-mortem attributes it to a new node operator exploiting the GG20 threshold-signature scheme, with solvency checks registering the problem only after the attack finished ^[9]. Aaluxx, a Maya founder, later said on THORChain's community podcast that three older bugs, none dangerous alone, became dangerous chained, and that Maya carried the same latent flaw ^[10]. Finding it took forensics down to cryptographic configuration parameters and a hunt for small primes that should not have been present ^[11]. A balance monitor, by contrast, reports the loss after the funds have moved ^[12].

That is the structural problem for defenders. An audit priced per contract finds broken lines. Nothing in that workflow prices the interaction between two controls that are individually correct. Aaluxx argues AI tooling now lets small teams look at a codebase from many angles at once, which helps defenders and equally gives attackers more paths to novel bugs that existing audit processes miss ^[13].

His answer was redundancy rather than integration: Maya and THORChain stayed separate, which let Maya keep serving swaps from a verifiably healthy vault while THORChain sat idle for weeks ^[14]. Worth noting what that independence did not buy. Operational separation held; code lineage did not, since the same latent flaw sat in both stacks ^[10]. Aaluxx said the team would work to fix and recover in full ^[8]. A treasury can refund $1.36 million of hard assets ^[6]. It cannot refund the roughly $9.6 million of damage that came from the repricing ^[1].