Peckshield: Maya Protocol Loses $1.7M, 20 BTC Traced to Wallet

What Peckshield Found

Peckshield said Maya Protocol, a decentralized multi-chain liquidity network, was exploited for astir $1.7 million, with the largest azygous portion of the haul, 20 BTC, traced to the code ‘bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646.’

Bitcoin.com News independently verified the wallet and confirmed it held 20.82730682 BTC arsenic of publication, each of it deposited successful 10 abstracted transactions connected August 18 astatine 17:32 UTC, indicating that the funds were drained and consolidated alternatively than accrued through integrated trading activity.

Image source: X

Maya Protocol operates arsenic a fork of Thorchain, utilizing Cosmos-SDK, Tendermint consensus, and threshold signature schemes to fto users swap assets crossed chains, specified arsenic bitcoin, ether, and USDC, without wrapping tokens oregon relying connected a centralized custodian. That cross-chain design, moving autochthonal assets betwixt blockchains that were ne'er built to speech to each other, is precisely the benignant of plumbing that has made bridges and liquidity routers a favourite people for hackers implicit the people of this year.

At the clip of writing, Maya Protocol co-founder and strategical pb Aaluxx Myth issued a nationalist connection confirming the exploit’s basal cause, adding that they’ve halted planetary operations until further notice.

A Familiar Pattern for Cross-Chain Protocols

Maya Protocol’s exploit adds to a twelvemonth that has been particularly punishing for cross-chain infrastructure. Peckshield’s ain tally recovered that span exploits unsocial drained $328.6 cardinal crossed eight large incidents successful May, and the steadfast separately flagged a $5.25 cardinal exploit that saw funds bridged from Hedera to Ethereum successful a suspected onslaught earlier this year.

Across each categories, monitoring firms person enactment cumulative 2026 hack losses northbound of $1.65 billion, erstwhile again shining a spotlight connected the information that adjacent mature, audited protocols stay exposed erstwhile cross-chain logic is involved.

The mechanics of these attacks vary, immoderate exploit astute declaration logic, others compromise validator keys oregon span relayers, but the result is consistent, i.e. liquidity that is expected to determination seamlessly betwixt chains alternatively flows consecutive into an attacker’s wallet.

What to Watch Next

Looking ahead, a fewer factors basal to find however things play retired from here. First, whether the nonstop onslaught vector comes to light, followed by whether the 20 BTC sitting successful the flagged wallet moves, and if so, whether it heads to a mixer, a bridge, oregon an speech that could frost it.

Lastly, it volition beryllium absorbing to spot whether the team’s connection of a bug bounty is accepted successful speech for returning funds, a dialog maneuver that has go progressively communal successful 2026 aft respective protocols recovered assets by offering white-hat deals alternatively than pursuing ineligible enactment alone. Interesting fewer days ahead, to accidental the least!