MAYAChain pulled the plug on its network after an estimated $1.7 million exploit that used six chained bugs to drain 48.87 million CACAO tokens in a single 23-message transaction. The token's price collapsed nearly 89% in the aftermath. The analysis so far is preliminary, and the network remains offline.
The chained-bug attack
The exploit wasn't a single flaw. Investigators describe six separate bugs that worked together, each one opening the door for the next. The final result was one transaction, 23 messages long, that walked away with tens of millions of CACAO tokens.
That kind of multi-step attack is hard to catch in real time. Each bug on its own might have been harmless, but chained together they gave the attacker a clear path. The project's team has not yet said which functions were involved or how long the bugs had been live.
The toll on CACAO
The token took a brutal hit. CACAO dropped nearly 89% after the exploit became public, wiping out most of its value in a matter of hours. For holders, that's a fast and painful loss. The exact dollar figure of the drain is still an estimate — $1.7 million — and could change as the investigation digs deeper.
That price drop also reflects trust. When a network halts and a chunk of its native token disappears, traders tend to run first and ask questions later. The 89% move shows just how quickly confidence evaporated.
Network halt and what's next
MAYAChain stopped its network to stop the bleeding and keep the attacker from moving more funds. That's a drastic step, but it's the kind of move that buys time for a proper fix. The team is now working through the preliminary analysis, trying to map out exactly how the six bugs fit together and what needs to be patched.
There's no word yet on when the network will come back online. The priority is making sure the same chain of bugs can't be used again. Until that's done, the halt stays in place.
The open question is whether the drained tokens can be recovered. That depends on how the attacker moved them and whether any of the funds are still traceable. For now, the network sits frozen, and the investigation continues.
