Maya Protocol, a cross-chain liquidity network that pools and moves assets across blockchains, has halted operations after attackers chained together six separate bugs to drain roughly $1.4 million in Bitcoin and other pooled assets. The team moved into an emergency shutdown of the network to contain the damage while it investigates the incident.

The attack was not a single mistake. First detailed by Decrypt, the exploit combined six distinct vulnerabilities into one exploit path, meaning the attacker had to string together multiple weaknesses in sequence to reach the funds. A multi-bug chain is harder to catch in a routine audit than an isolated vulnerability, because each individual flaw may look low-risk until it is linked to the next.

Maya itself launched in 2023 as a community-led fork of THORChain, a longer-running cross-chain liquidity network, so the incident involves a codebase lineage that has been live for years rather than a brand-new design.

How the Exploit Unfolded

Maya Protocol stopped its network after an attacker exploited its liquidity pools. The team moved to a full halt once the drain was detected, cutting off further transactions across the chain.

Reporting from CoinDesk described the exploit draining Bitcoin alongside other assets, with pool value dropping by roughly $11 million as the attack played out. The timeline was compressed: the exploit was detected, the loss confirmed, and the protocol halted in short order rather than over days.

Why the Hack Matters for Cross-Chain Security

A network-wide halt is a blunt instrument, and reaching for it signals the team judged the threat severe enough to freeze all activity rather than patch in place. For users, that means funds and access are effectively locked while the investigation runs, with no normal deposits, swaps, or withdrawals until the network resumes.

The choice to denominate the theft in Bitcoin sharpens the impact. Maya and similar cross-chain liquidity systems custody real assets across chains — Bitcoin held in pools backs activity elsewhere — so a breach in the coordination layer converts directly into hard losses rather than a dip in paper token value.

Lessons for DeFi Protocol Security

The six-bug structure is the core lesson. It echoes a pattern seen elsewhere in Bitcoin-adjacent infrastructure, where a Bitcoin bridge was shut down after bugs surfaced in its code, underscoring that cross-chain plumbing remains a high-value target. The record bears that out: THORChain — the protocol Maya forked from — was drained twice within two weeks in July 2021, and some of the largest thefts in crypto history, from the roughly $600 million Ronin Network bridge hack to the $325 million Wormhole exploit in 2022, all targeted the infrastructure that moves assets between chains.

Layered failures reward the kind of adversarial testing now driving efforts to AI red-team core Bitcoin projects, which probe for exactly these chained exploit paths. The security angle also intersects with a broader push to automate vulnerability discovery, from large-scale AI security audits spanning hundreds of projects to teams applying models directly against protocol code.

What security researchers and investors will watch next is whether Maya can trace the full exploit chain, recover or reimburse the drained assets, and restart the network without reopening any of the six flaws. Until those questions are answered, the network stays frozen and normal activity stays suspended.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.