Maya Protocol Hack: Why the Recovery Plan Mirrors THORChain’s Old Playbook

MakeCryippreferred on

• An attacker drained roughly $1.7 million from Maya Protocol on August 18 by faking a subsidy inside the ARB.LINK pool’s accounting, then repeatedly adding and removing liquidity to pull out CACAO and LINK tokens.
• More than 20 BTC tied to the exploit, about $1.34 million, sits untouched in a single Bitcoin address, a balance independently confirmed against mempool.space.
• Founder Aaluxx says Maya will backfill the pool using money from outside sources rather than recovering the stolen funds, the same approach its parent chain, THORChain, took after both of its own major exploits in 2021 and 2026.

About 11 hours after Maya Protocol’s founder disclosed a $1.7 million exploit, the attacker’s Bitcoin address still holds every satoshi it received: 20.82731228 BTC, worth about $1.34 million, unmoved since it landed there on August 18. Maya isn’t waiting on that wallet to empty out to fix the damage. Founder Aaluxx says Maya will make the liquidity pool whole using money from other projects instead, not by getting the stolen funds back. That isn’t an improvised fix. It’s the same move THORChain, the codebase Maya is forked from, has made twice before.

The mechanics of the drain

Security monitor CertiK flagged the exploit hours after it happened, describing how the attacker inflated the accounting on Maya’s ARB.LINK pool with a false subsidy, then cycled liquidity in and out of the pool to extract value that wasn’t really there. The result, per CertiK’s on-chain breakdown, was about 48.87 million CACAO and 98.82 LINK pulled from shared liquidity. A separate breakdown attributes the exploit to a chain of six bugs, including a transaction-tracking failure and an uncapped slashing calculation that let the pool’s CACAO balance get inflated before the withdrawal. CACAO, Maya’s native token, crashed roughly 88% in the process before partially recovering.

Maya’s founder won’t call it a hack

Aaluxx’s own disclosure is notably hedged. “Attacker’s address, if intentional, is bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646,” he wrote, leaving open the possibility that Maya doesn’t actually know whether this was a deliberate attack or a bug that got triggered without anyone meaning to exploit it. That’s an unusual admission for a protocol asking the public to trust its account of what happened, and it complicates the standard “hacked” framing most early coverage has used without question.

THORChain’s family tree has been drained before

Maya Protocol is built as a fork of THORChain, and THORChain’s codebase has a track record here. In May 2026, THORChain itself lost $10.7 million when one of its Asgard vaults was compromised; Maya halted its own nodes afterward as a precaution, though no shared root cause between that incident and this one has been confirmed. Further back, THORChain was hit by three separate seven-figure exploits within a single month in 2021, for combined losses over $13 million. Repeated exploits across forks and versions of the same underlying design are the pattern here, not a one-off failure specific to Maya.

The fix follows THORChain’s old playbook

Neither of those earlier incidents ended with the stolen money coming back from whoever took it. After the 2021 hack, the THORChain community donated funds back into the affected Ethereum pool to make liquidity providers whole, rather than recovering what the attacker had taken. After the May 2026 vault exploit, THORChain’s own incident report said the recovery approach would be decided through community governance, naming protocol-owned-liquidity absorption as one of the options on the table, rather than committing to recovering the stolen funds from whoever took them. Neither time did recovering the attacker’s funds become the actual plan. Aaluxx is now describing the same shape of plan for Maya: donate an equivalent 20 BTC from other sources, including proceeds tied to its Aztec Chain project, to bring CACAO back toward its pre-exploit price, with nothing said about getting the original 20.827 BTC back from the address where it’s currently sitting.

No post-mortem yet, and the funds haven’t moved

Maya has not published a formal post-mortem as of this writing. Aaluxx’s own posts promise “more info” is coming, but the detailed technical breakdown circulating publicly so far comes from outside analysts, not the team itself. The attacker’s address hasn’t sent a single transaction out, and CACAO’s recovery depends on Maya following through on its stated plan to backfill the pool from elsewhere. Until one of those two things changes, either the wallet moves or Maya publishes what actually happened, a familiar pattern from THORChain’s own history is the clearest sign of where this is likely headed: the loss gets absorbed, not reversed.