Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

The suspected Bitcoin address at the center of Maya Protocol’s Aug. 18 exploit still held about 20.8273 BTC with no outgoing spend on Aug. 21, while no published recovery plan accounted for the much larger estimated impact across the cross-chain liquidity protocol’s pools.

Public Bitcoin data showed 20.82731228 BTC funded, zero spent, 11 confirmed transactions and none waiting in the mempool. Ten initial deposits totaling 20.82730682 BTC arrived at 17:32:18 UTC on Aug. 18, while a later 546-satoshi transaction raised the total slightly. At today's Bitcoin price, the balance was worth about $1.59 million.

Maya Protocol founder Aaluxx initially said the network had likely lost about 20 BTC, worth roughly $1.4 million at the time, plus about $300,000 in other assets. He said he would work to fix the incident and recover in full.

Why replacing 20 BTC would not make pools whole

A technical reconstruction by SigIntZero attributed the exploit to six accounting and state-handling flaws chained inside one 23-message transaction. It said overwritten outbound state produced a false missing-transfer signal, activating a compensation path that credited about 49.45 million CACAO to a thin ARB.LINK pool even though Maya’s reserve held only about 168,000 CACAO.