Mayan: how it works, risks and reviews

In short

Type
Intent-based swaps: drivers fill orders from liquidity they already hold on the destination chain (Swift).
Risks and caveats
Cross-chain message security depends on Wormhole's Guardian network.
Checked
1 November 2026

Visitor ratings: do you like Mayan?

On-chain stablecoin data

Stablecoins held in its contracts (floor)
At least US$0.18 m, read on 23 of its 23 contracts on 1 November 2026
Stablecoin flows, 7 days (25 October 2026 – 31 October 2026)
Locked US$115.27 m, released US$136.69 m, net −US$21.43 m

On-chain measurement by Stablecoin Scanner (ACHIVX), not a reserve or solvency claim. As of 31 October 2026. For a bridge the scanner counts a lock as inflow and a release as outflow; its set is the contracts named by the bridge’s own deployment list or L2BEAT. scanner page ↗

Key facts

Official site
mayan.finance

Key facts checked on 1 November 2026 against official sources.

What is Mayan

Mayan is a cross-chain swap protocol: competing solvers, which Mayan calls drivers, deliver the user's output on the destination chain from their own capital. It uses Wormhole messaging and Circle's CCTP for settlement, and offers an app, an SDK/API and a widget.

Network and consensus

Network and consensus — Mayan
ParameterDetails
TypeIntent-based swaps: drivers fill orders from liquidity they already hold on the destination chain (Swift).
Transfer methodsThree methods: Swift (intents), MCTP (USDC via Circle's CCTP) and Wormhole Swap (Wormhole Token Bridge).
Supported chainsThe Chains & Contracts table lists 14 chains: Solana, Ethereum, BNB Smart Chain, Polygon, Avalanche, Sui, Arbitrum, Optimism, Base, Linea, Unichain, HyperEVM, Monad, HyperCore.
Message validationCross-chain messages are validated by Wormhole's Guardian network (13 of 19 signatures).
CustodyContracts are permissionless and non-custodial; Mayan says no single party can freeze or move assets in them.
Transfer sizeSwift carries single transfers up to about $1M depending on the chain; MCTP up to about $10M.
FeesSwift has no protocol fee; integrators can add a referrer fee on top.
ComplianceTransactions are screened with Chainalysis and Hermod by zeroShadow; flagged addresses may be blocked.

Who develops and governs Mayan

Legal entity
The terms name Sand Lake Labs, Ltd., doing business as Mayan Finance, as the service provider; the terms are under New York law.
Founders
Mo Elahi is named as Mayan's co-founder.
Funding
Mayan raised a $3 million seed round co-led by 6th Man Ventures and Borderless Capital (April 2024).

History

History — Mayan
DateEvent
26 October 2022Mayan announced an OtterSec audit of its smart contracts.
11 April 2024Mayan announced a $3 million seed round.
30 December 2025In its 2025 review Mayan said it added routes to Sui, HyperEVM, Monad and Fogo.
24 March 2026Mayan 2.0 upgraded the protocol and added Zaps (swaps combined with destination actions).

Security and audits

Security incidents

No security incident is recorded in the sources checked on 1 November 2026 (the company’s own channels and incident databases): defillama.com/hacks, hacked.slowmist.io, rekt.news/leaderboard, mayan.finance/blog, docs.mayan.finance/resources/audits

Risks and caveats

Official links

Questions and answers

What is Mayan?

Mayan is a cross-chain swap protocol where competing drivers deliver the user's output on the destination chain; it uses Wormhole messaging and Circle's CCTP.

Who operates Mayan?

Mayan's terms name Sand Lake Labs, Ltd., doing business as Mayan Finance.

Which chains does Mayan support?

The docs list 14 chains, including Solana, Ethereum, Base, Arbitrum, BNB Smart Chain, Sui, Monad and HyperEVM.

Does Mayan have a token?

Mayan's official sources name no token.

Is Mayan audited?

Mayan says its contracts and Solana programs were audited by OtterSec and Sec3.

Sources

More in this section

How voting works

Votes are anonymous and carry no text. Each device has one vote per item; press the same button again to remove it. Cloudflare Turnstile checks that a person is voting. We keep a random device ID in a cookie and a salted hash of the IP address to limit abuse — no names, no accounts. Votes are visitors’ opinions, not investment advice.

Page updated: