Maya Protocol hack: Attackers still hold 20.83 BTC on the third day

The Maya Protocol was targeted by a hacking attack on August 18, aimed at its cross-chain liquidity protocol. As of August 21, three days later, a Bitcoin address suspected of being linked to the attack still holds 20.8273 BTC, with no recorded withdrawals. According to publicly available Bitcoin on-chain data, this address received 20.82730682 BTC through 10 initial deposits on August 18 at 5:32:18 PM (UTC). Subsequently, 546 satoshi transactions were added, resulting in a total of 11 confirmed transactions. Based on the current Bitcoin price, the balance in this address is approximately $1.59 million. On-chain analyst SigIntZero explained that this attack exploited six interconnected accounting and state processing vulnerabilities within a single transaction containing 23 messages. The attacker generated a false transmission failure signal by overwriting the outbound state, which activated the reward pathway. Despite only having approximately 168,000 CACAO in the Maya reserve, approximately 49.45 million CACAO were deposited into the ARB.LINK pool. Although the reserve transfer itself failed, the inflated balance remained. After adding a small amount of liquidity, the attacker secured approximately 99.93% of the ownership units in that pool, withdrew approximately 48.87 million CACAO, and swapped it for assets held by another pool within the MAYAChain. According to SigIntZero's estimates, approximately $1.36 million worth of assets were transferred to external chains, while about $291,000 remained within the MAYAChain. The total value of assets directly controlled by the attacker is estimated to be between $1.65 million and $1.7 million. Separately, the total losses to the entire ecosystem are estimated at approximately $10.9 million. According to CryptoSlate's analysis, of this amount, about $6.4 million is attributed to the CACAO redenomination, and approximately $2.9 million is due to arbitrage losses incurred during the period when the token price plummeted from about $0.115 to $0.013, a decrease of 88.7%. Maya Protocol founder Aaluxx stated that he initially lost approximately 20 BTC and around $300,000 worth of other assets, and that he will strive to recover the full amount. The Maya team is hoping for a voluntary return through a bug bounty program, and if that fails, they are reportedly considering options to replace the approximately 20 BTC, such as investments in the Aztec chain. However, even if these Bitcoins are returned or replaced, it would only be a portion of the total losses. As of the time of writing, Maya has not yet publicly released a formal plan outlining the final pool ledger, compensation terms, and who will bear the losses incurred through transactions during the CACAO redenomination and price volatility period.