Maya Protocol Six-Bug MAYAChain Exploit — Uncapped Slash Subsidy Drain

T0 (Aug 18, ~17:30 UTC): Attacker submits a single 23-message MsgDeposit transaction at block 17,977,941, triggering the chained six-bug exploit. T+1 min: Block 17,977,971 — attacker adds/withdraws liquidity, extracting ~48.87M CACAO and 98.82 ARB.LINK after gaining 99.93% ownership of the artificially inflated ARB.LINK pool. T+2-3 min: Blocks 17,977,998-17,978,008 — attacker executes 8 sequential swaps of 4,000,000 CACAO each, converting the bulk of extracted value into 20.82730682 BTC, consolidated at bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646. T+4 min: Block 17,978,094 — CACAO price bottoms at $0.013, down 88.7% from its pre-exploit price of $0.115, within under 240 blocks. Within the hour: Maya Protocol halts the network globally as a precaution. Founder @AaluxxMyth posts publicly: 'Sad news. Will work to fix and recover in full,' and signals intent to fund partial compensation via proceeds from an upcoming Aztec Chain investment, and offers a whitehat bounty to the attacker for return of funds. Aug 19, 06:10 UTC: @PeckShieldAlert publicly confirms the exploit at ~$1.7M total value, citing the BTC consolidation address holding the majority of extracted funds (~$1.34M in BTC). Aug 19-21: CertiK and Defimon publish independent technical breakdowns confirming the six-bug chain and the exact block-by-block extraction sequence. As of Aug 21, the network remains halted/paused, no funds have been returned, and the attacker's BTC and residual CACAO holdings remain untouched.