Maya Protocol Halts Network After Six-Bug Exploit Drains $1.4M in Bitcoin

Cross-chain swap network Maya Protocol stopped its chain on Wednesday following an exploit that combined six distinct bugs and removed about $1.4 million in Bitcoin, Decrypt reported at 18:20 UTC on 19 August 2026.

That is the extent of what is on the record so far. Decrypt's account attributes the halt to the exploit and puts the loss at $1.4 million in BTC. Two details matter and are both absent from the public record at this hour: Maya Protocol has not put out a post-mortem, an incident statement, or a loss figure of its own, and no attacker address, transaction hash, or block height has been published to let anyone verify the number on-chain independently. Until one of those appears, $1.4 million is a single-outlet figure, not a confirmed one.

For scale, Bitcoin was quoted at $68,277 on Decrypt's price board at the time of publication, which puts the reported loss at roughly 20.5 BTC. Whether the stolen amount was denominated and valued at that price, or at some earlier mark, has not been stated. RUNE — the token of THORChain, the codebase Maya's design descends from — was quoted at $0.4201 on the same board. Maya's own CACAO token does not appear on it, so there is no price reference for the network's native asset here.

Key facts

• Maya Protocol halted its network after an exploit chaining six separate bugs — Decrypt, 19 Aug 2026, 18:20 UTC.
• Reported loss: approximately $1.4 million in Bitcoin — Decrypt, same report.
• BTC quoted at $68,277 on Decrypt's price board at publication; ~20.5 BTC at that mark (Cleartext's arithmetic, not a figure either party published).
• No attacker address, transaction hash, block height, or recovery plan has been disclosed by any party.
• No statement from Maya Protocol had been published as of this writing.

The real-world read

"Six bugs" is the tell. A single-bug drain is bad luck; a six-step chain means an attacker walked through multiple layers of a system that was audited or assumed sound, and it usually means the discovery surface is wider than the first loss figure suggests. Halting a chain is not a routine measure — teams do it when they can't yet bound the damage. That the halt and the $1.4 million number arrived together, from a secondary outlet, with no incident report behind them, is the gap worth watching: early loss estimates in cross-chain exploits are revised upward far more often than downward, and the party best placed to correct the figure has said nothing.

Opinion, and whose

None on the record. No named analyst, firm, or Maya representative has offered an assessment, a recovery estimate, or a cause attribution. Any number circulating beyond $1.4 million at this point traces to no source.

Sources

• Decrypt (Tier 2, reputable secondary), 19 Aug 2026 — "Six-Bug Exploit Halts Maya Protocol After $1.4 Million in Bitcoin Stolen." Sole source for the halt, the six-bug characterization, and the loss figure; Decrypt does not name a primary source for the number in what it published. Also the source of the BTC and RUNE quotes cited above.
• No primary sources — no Maya Protocol statement, on-chain forensics, or security-firm analysis — were available at publication. This story will need updating when one exists.

Not financial advice.