A multi-bug interaction in MayaChain’s outbound/slashing and pool-accounting flow caused a staged ARB.LINK pool to be credited with approximately 49.45M CACAO that was never actually transferred into the pool. Multiple messages sharing one native transaction ID caused the final DONATE message to overwrite outbound tracking state, making legitimate LINK outbounds appear missing. MayaChain consequently treated them as unauthorized vault outbounds and invoked slashing. During the resulting subsidy calculation, pool state was updated with an uncapped CACAO credit before the corresponding Reserve-to-Asgard transfer was attempted. That transfer failed because the Reserve lacked sufficient CACAO, but the inflated pool state was not rolled back. The attacker then added liquidity to the effectively asset-empty ARB.LINK pool, obtained nearly all pool ownership, and withdrew approximately 48.87M CACAO from Asgard liquidity

Maya Protocol (MAYAChain) suffered a security vulnerability attack. The attacker exploited 6 chained edge-case bugs in Trade Account, outbound handling, and pool math, inflating accounting via false subsidy (e.g., ARB.LINK pool), then added/removed liquidity to extract ~48.87M CACAO and convert to ~20.83 BTC plus other assets, causing ~$1.7 million loss. The team paused global operations to fix the issues and seeks fund recovery.