Kava Lend hack drains about $3.8 million, sends KAVA token sharply lower

Traders Union
All News
Crypto
Kava Lend $3.8M hack

Highlights

An attacker exploited Kava Lend by inflating BUSD collateral, draining about 55.2 million KAVA tokens worth approximately $3.76 million at pre-attack prices.
KAVA price plunged around 39% to $0.042 within 24 hours, as the attacker quickly sold most stolen tokens after bridging them to BNB Chain.
Kava publicly acknowledged unusual activity over seven hours after the exploit began and paused partner exchange deposits, withdrawals, and the Axelar bridge out of caution.

Exploit mechanics and fund movements

As first reported by The Block, the attacker drains about 55.2 million KAVA tokens from Kava Lend after inflating the value of BUSD deposits in the protocol's dormant stablecoin market and then borrowing against that collateral. Onchain data reviewed by the outlet shows the stolen tokens are worth roughly $3.76 million at KAVA's pre-attack price of about $0.068.

Kava Lend's module account, where pooled deposits sit, falls from 55.33 million KAVA to 0.19 KAVA in a little more than 90 minutes. The exploit centers on the BUSD market, which is largely empty before the attack after Paxos stopped minting the Binance-branded stablecoin in 2023.

Under Kava Lend's public code, depositor earnings are calculated by dividing borrower interest by a market's net supply. The code skips that division only when net supply is exactly zero, but does not block extremely small positive balances. At 11:01 p.m. ET on Friday, the attacker uses a small BUSD loan to push net supply down to two hundred-millionths of a dollar, then over the next three minutes the protocol multiplies the value of every BUSD deposit by roughly 243,000 times.

That mechanism causes BUSD previously deposited by the attacker to be counted as about 1.25 billion BUSD in collateral. The attacker then borrows KAVA 127 times, using a second account to clear each loan and bypass Kava Lend's cap on KAVA borrowing. The wallet activity suggests preparation began at least a week earlier, with repeated deposit and borrow cycles in the BUSD market from Nov. 8.

Market fallout and Kava response

Beginning at 4:59 a.m. ET on Saturday, the attacker bridges about 49.2 million KAVA to BNB Chain through Kava's LayerZero bridge. Most of those tokens are sold within an hour for 3,006.5 BNB and 231,557 USDT, worth about $2.09 million combined, while another roughly 4.58 million KAVA is sent to five unlabeled addresses on Kava.

Kava says on X at 6:28 a.m. ET on Saturday that it is tracking unexpected behavior originating from a dApp within its ecosystem, marking its first public acknowledgment more than seven hours after the attack begins. In a follow-up post about 30 minutes later, the team says it is aware of the bridging and sale of KAVA tokens on BSC and adds that the event is not an infinite mint, but is isolated to Kava Lend.

The company has not published an official loss figure or a post-mortem report. KAVA trades near $0.042 at the time of publication, down about 39% over the past 24 hours, and Kava says partner exchanges pause deposits and withdrawals as a standard precautionary measure.

At 9:05 a.m. ET, Kava says it pauses the Axelar bridge out of caution, although the drained KAVA leaves the network through LayerZero. The incident follows other lending protocol exploits this year, including Cronos halting its network in August after a roughly $75 million exploit of Tectonic and Hedera-based Bonzo Lend being hit for about $9 million in July.

Previously, we highlighted the bearish CRO outlook as Cronos traded under key moving averages with persistent selling pressure.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.