Kava Lend Exploit Drains 55.2M KAVA, Token Drops Up to 47%
A rounding edge case in Kava Lend's interest math let an attacker inflate BUSD collateral roughly 243,000-fold and drain 55.2 million KAVA, about $3.76M at pre-attack prices. Most was bridged to BNB Chain and sold for about $2.09M, leaving lenders facing a liquidity shortfall.
An attacker drained about 55.2 million KAVA from Kava Lend, the native lending protocol of the Layer 1 chain Kava, in an exploit that began late Friday, U.S. Eastern time. At the pre-attack price of $0.068, those tokens were worth roughly $3.76 million. The token fell as much as 47% over the following 24 hours.
Kava Lend's module account, where the protocol's pooled deposits sit, went from 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half. The attacker worked through a dormant BUSD market, inflating the value of a deposit there and then borrowing KAVA against it.
Price figures depend on when they were taken. CoinGecko's aggregated feed showed KAVA near $0.0362, down 46.6% over 24 hours, as of 7:12 p.m. ET on Saturday, Nov. 14. An earlier reading that evening put it near $0.042, down about 39%.
How the attack worked
The flaw sits in how Kava Lend accrues interest. It divides interest by a market's net supply, and per the protocol's public source code it skips that division only when the figure is exactly zero, not when it is merely tiny. Think of a ratio whose denominator is almost nothing: the result explodes.
At 11:01 p.m. ET Friday, the attacker used a small BUSD loan to bring the market's net supply down to two hundred-millionths of a dollar. Deposit values were then multiplied roughly 243,000-fold over three minutes, so the attacker's BUSD counted as about 1.25 billion BUSD of collateral. That market is built on BUSD, the Binance-branded stablecoin that issuer Paxos stopped minting in 2023.
The attacker borrowed KAVA 127 times, using a second account to clear each loan and sidestep the KAVA borrowing cap. Onchain activity suggests the preparation began as early as Nov. 8. Blockchain data provider Bitquery said the second wallet's liquidations closed loans with almost no BUSD left to cover them.
Funds moved and sold
Bitquery put gross borrowing at 55.2 million KAVA, with the two wallets keeping 53.9 million after repaying other borrowers' loans. Starting at 4:59 a.m. ET Saturday, about 49.2 million KAVA was bridged to BNB Chain via LayerZero. Most of it was sold within the hour for 3,006.5 BNB and 231,557 USDT, about $2.09 million in all. The BNB has since been moved out, and about 4.58 million KAVA went to five unlabeled addresses on Kava.
The roughly $3.8 million figure attached to the exploit values the tokens at pre-attack prices, so it overstates what the attacker actually realized.
Kava's response
Kava first acknowledged the incident at 6:28 a.m. ET Saturday, more than seven hours after the attack began.
"We are tracking unexpected behavior originating from a dApp within the Kava ecosystem"
Kava (@KAVA_CHAIN)
In a follow-up, Kava said the event "is isolated and contained within Kava Lend" and stressed: "This is not an infinite mint."
At 9:05 a.m. ET it paused Axelar bridge withdrawals as a precaution, though the drained KAVA had left via LayerZero. Kava has promised a complete incident report and has not yet given an official loss figure.
Korean exchanges moved quickly. Upbit suspended KAVA deposits and withdrawals on Nov. 14 and issued a trading caution, and Bithumb and Coinone also suspended KAVA transfers.
What it means for lenders
"Contained" does not mean lenders are made whole. The distinction Kava drew is real, since the attacker took existing tokens from a pool rather than minting new supply, but Bitquery said the pool owed lenders about 55.2 million KAVA while holding 0.19 KAVA on Nov. 14, a liquidity shortfall. It added that the attacker's inflated BUSD claim remains outstanding, which exposes any later BUSD deposits.
The exploit extends a run of lending-protocol losses this year: Cronos halted its network in August after a Tectonic exploit estimated at $75 million, and Hedera's Bonzo Lend lost roughly $9 million in July. The Kava case shows how a dormant market with thin liquidity can become an attack surface. As new designs arrive, such as the XRPL lending amendment now collecting validator votes, edge-case math in accounting code remains a core risk.
