MayaChain pauses operations after attackers drain cross-chain liquidity pools
A security breach on MayaChain’s THORChain-based protocol led to a temporary halt and an estimated $1.7 million loss.
MayaChain, a decentralized exchange protocol that facilitates cross-chain swaps, has temporarily suspended network activity after an exploit drained approximately $1.7 million in digital assets. The incident, which occurred on February 28, 2025, targeted the protocol’s liquidity pools on the THORChain network, prompting developers to freeze operations to contain the damage.
How the exploit unfolded
According to on-chain analysis shared by the team, the attacker exploited a vulnerability in MayaChain’s custom swap logic, enabling them to withdraw funds repeatedly without proper reconciliation. The breach was detected within minutes, but the attacker had already managed to extract a mix of Bitcoin, Ethereum, and other cross-chain tokens before the network could be paused.
Key details of the incident include:
- Attack vector: A flaw in the smart contract’s handling of swap confirmations allowed the attacker to bypass balance checks.
- Assets affected: The stolen funds included BTC, ETH, and several ERC‑20 tokens, with the total loss estimated at $1.7 million.
- Response: Validators were instructed to halt the network, and the team began a security audit of the affected code.
MayaChain’s developers have stated that they are working with security firms to trace the stolen funds and identify the perpetrator. In a statement on the project’s official Discord, they emphasized that user funds in non‑affected pools remain safe and that a post‑mortem report will be published once the investigation is complete.
“We are treating this with the utmost seriousness. Our priority is to secure the remaining liquidity and restore trust through full transparency,” a MayaChain core contributor said.
The incident underscores the ongoing risks in the DeFi sector, where complex cross‑chain mechanisms often introduce novel attack surfaces. While MayaChain has resumed limited operations after patching the vulnerability, the event serves as a reminder of the importance of rigorous code auditing and real‑time monitoring.
