主要洞察
- 加密货币 hack news: Maya Protocol 在发生 170 万美元的漏洞攻击后暂停。
- 攻击者在操纵池账户记账后，盗走了4,887万枚CACAO。
- 由于套利活动加剧了更广泛的池价值损失，CACAO暴跌了88.7%。
On August 18, Maya Protocol suspended MAYAChain following an exploit involving six interconnected software vulnerabilities. This crypto hack incident resulted in approximately $1.7 million in losses controlled by the attacker. According to Maya co-founder Aalux, the team managed to limit further damage and commenced remediation efforts.
The event was notable because a single transaction leveraged multiple accounting and execution flaws simultaneously. The perpetrator converted the manipulated protocol balances into ETH as its native asset.">Ether, 比特币, stablecoins, and RUNE. Furthermore, this situation differed from a typical 加密货币 诈骗，因为造成财务损失的是软件漏洞，而不是用户欺诈。
加密黑客新闻：MAYAChain在遭遇六漏洞攻击后暂停运行
Aalux stated that the attacker absconded with about 20 比特币 alongside an additional $300,000 worth of assets. He noted that Maya enforced a global protocol pause immediately upon uncovering the security breach. Subsequently, the development team began preparing patches prior to re-enabling token swaps.
Independently, CertiK Alert estimated the damages to be close to $1.7 million. Their evaluation classified the occurrence as a smart contracts instead of banks and brokers.">decentralized finance exploit rather than a wallet compromise or phishing attack. This distinction is important because the vulnerability targeted pool accounting and protocol logic directly.
安全研究人员 Vini Barbosa 报告称，一连串六个不同的漏洞促成了此次攻击。他的分析表明，单笔交易包含 23 条消息，并引发了绝大部分恶意活动。执行序列影响了流动性池计算、交易账户和出站交易处理。
Barbosa计算得出，攻击者向外部区块链网络转移了约136万美元。如果算上二级市场的影响，他对该协议受到的总影响的估计接近1100万美元。这个更广泛的总额包括了CACAO的贬值和套利活动，而不仅仅是被盗资金。
攻击是如何操纵池账户记账的
根据Barbosa的技术概述，批处理存款消息覆盖了现有的ObservedTxVoter条目。最终的捐赠有效负载取代了先前的投票者信息并重置了出站区块高度，从而改变了MAYAChain评估后续出站交易的方式。
因此，出站匹配器在评估合法转账时应用了错误的高度。Barbosa指出，网络错误地将有效的出站标记为缺失，这触发了协议内部的盗窃检测机制。
随后的漏洞涉及低流动性ARB.LINK池中的估值计算。Barbosa指出，补贴数学计算缺乏与池实际深度挂钩的适当上限，在记账价值中产生了约4,945万个CACAO单位。
An additional execution error occurred when the pool state was committed before a module transfer finished. Because the reserve only held about 168,000 CACAO, the funding step failed. Although the error handler logged the issue, it proceeded without rolling back the prior state modification.
随后，袭击者向膨胀的池中注入了少量的流动性。Barbosa解释说，在攻击者提取4,887万枚CACAO之前，这个微小的头寸占据了99.93%的所有权，随后攻击者将这些资金的一部分兑换成了外部数字资产。
加密黑客新闻：CACAO暴跌加剧了池资金损失
Barbosa observed CACAO plummet from roughly $0.115 to $0.013 during the security incident, marking an 88.7% collapse across fewer than 240 blocks. This severe repricing magnified the deficits sustained by pools pairing CACAO with other digital currencies.
CoinGecko的数据随后显示，8月19日CACAO回升至0.123美元左右，表明其从 exploit 期间记录的低点有所反弹。在网络停机期间，薄弱的流动性和受干扰的交易环境使得跨不同交易场所的直接比较变得困难。
CoinDesk引用的初步分析显示，池价值的更广泛跌幅约为1090万美元。这一数字考虑了CACAO的重新定价和套利动态，这意味着它并不反映黑客直接持有的代币。
这种差异也限制了与传统 加密骗局 loss metrics. Exploit accounting often incorporates secondary market consequences, unrecovered protocol balances, and stolen funds—metrics that evaluate entirely distinct categories of harm.
加密黑客新闻：恢复工作与下阶段网络进展
Aalux confirmed that Maya intends to pursue code fixes and asset recovery. His public remarks also verified that the network blackout remained active as part of the ongoing containment strategy. At the time of the update, Maya had not announced a confirmed restart schedule.
Maya 的官方文档强调，网络偿付能力与安全保障是协议的基础组成部分。这起事件表明，当特定的边缘情况组合出现时，相互配合的安全协议仍可能失效。初步调查主要集中在这些组合执行路径上。
Barbosa 指出，这种特定的攻击向量在 THORChain上并不可行。他的评估仅限于 Maya 最初审查中概述的精确漏洞序列，并未排除存在完全独立漏洞的可能性。
展望未来，需要关注的主要里程碑是技术补丁的发布或 Maya 网络的重新启动。观察人士还应留意开发团队是否会发布确切的损失清算数据，以厘清未偿协议负债和找回的资金。
常见问题解答
是什么导致了 Maya Protocol 漏洞利用事件？
此次漏洞利用是由六个相互关联的软件缺陷引发的，这些缺陷操纵了流动性池记账和协议逻辑，而非通过欺诈用户实现。
Maya Protocol 黑客事件中损失了多少资金？
攻击者直接控制的损失估计约为 170 万美元，而由于市场效应，更广泛的流动性池价值影响达到了近 1100 万美元。
MAYAChain 在遭受攻击后关闭了吗？
是的，Maya 联合创始人在漏洞利用发生后立即实施了全局网络暂停，以遏制损失并准备安全修复。
漏洞利用对 CACAO 代币产生了什么影响？
在事件发生期间，CACAO 暴跌 88.7%，从约 0.115 美元跌至 0.013 美元，随后才显现出恢复迹象。
