MAYAChain exploit analysis

On 18 August 2026, the Maya Protocol announced that an attacker had stolen 20 BTC (then worth about $1.4 million) and various other assets totaling $1.76 million from the cross-chain liquidity network. A postmortem published by the protocol disclosed that the "sophisticated attacker exploited six chained bugs" to steal the assets. The Maya founder wrote on Twitter that "The bugs exploited were not caught by Halborn audit, nor Fable 5 audit". Halborn is a blockchain security firm; Fable 5 is an AI model developed by Anthropic, which Maya had used as an automated auditor.

The mechanism was a chain of six separate flaws in the lending and swap logic, used in sequence. The postmortem itself was the source that identified the "six chained bugs" framing, but the technical detail of which six bugs, in what order, and against which markets, was not fully disclosed in the public postmortem. The Maya founder's note about the audits is the most informative single line in the public reporting: that two audit processes, one human-led and one AI-led, both failed to flag the chained vulnerability. The incident is therefore notable as much for what it says about the limits of pre-deployment audits as for the loss itself.

The figure is the protocol's. The Maya Protocol announced $1.76 million, broken down as 20 BTC plus other assets. The breakdown is in the protocol's announcement rather than the third-party press; The Defiant reported the same number. The web3isgoinggreat account splits the loss across both legs. No outlet reported a different total.

The response was a public postmortem and an acknowledgement that both of Maya's stated audit engagements had missed the bug chain. Maya did not announce a recovery plan, a bounty, or an identification of the attacker in the reviewed reporting. The protocol continued operating after the attack.

Compared with the other 2026 lending and cross-chain incidents in the corpus, the Maya case sits with the Cronos/Tectonic exploit and the Moonwell MAMO drain as another instance where a structured attack walked through a sequence of small flaws to drain real funds. The audit point is its distinguishing feature. The Term Finance exploit of 23 August used a governance vector that audits would not catch regardless. The Coinsbuy and Triple-A exchange-style incidents did not involve audits. The Maya case is the one where the protocol publicly stated that two audits had failed, and where one of those audits was an AI model.