Kava Lend, the native lending protocol of Layer 1 blockchain Kava, suffered an exploit late Friday that drained roughly 55.2 million KAVA tokens, worth about $3.76 million at the pre-attack price of $0.068. The protocol’s module account fell from 55.33 million KAVA to 0.19 KAVA in about 90 minutes.
The attacker targeted a nearly empty BUSD stablecoin market, which had been largely dormant since Paxos stopped minting BUSD in 2023. Kava Lend’s code skips an interest calculation division when a market’s net supply is exactly zero, but it does not check for minute balances above zero. At 11:01 p.m. ET on Friday, the attacker used a small BUSD loan to lower the market’s net supply to two hundred-millionths of a dollar. Within three minutes, the value of BUSD deposits was multiplied roughly 243,000-fold. An earlier attacker deposit was then counted as approximately 1.25 billion BUSD in collateral.
The attacker borrowed KAVA against that inflated collateral 127 times, using a second account to clear loans and bypass the protocol’s borrowing cap. Onchain records indicate the attacker began testing deposit and borrow cycles in the BUSD market as early as Nov. 8.
The stolen funds were moved off the network starting at 4:59 a.m. ET on Saturday. About 49.2 million KAVA was bridged to BNB Chain through Kava’s LayerZero bridge and mostly sold within an hour for 3,006.5 BNB and 231,557 USDT, worth around $2.09 million. Another 4.58 million KAVA was sent to five unlabeled addresses on Kava.
KAVA fell nearly 40% over 24 hours, trading near $0.042. Partner exchanges Upbit, Bithumb and Coinone paused deposits and withdrawals as a precaution, and Upbit placed KAVA on its delisting watchlist. Kava first publicly acknowledged the incident more than seven hours after it began, saying the activity was isolated and contained within Kava Lend and was not an infinite mint. The team also paused the Axelar bridge out of caution, although the drained tokens left through LayerZero.
Kava has not published an official loss figure or post-mortem report. The exploit follows other lending protocol incidents this year, including a roughly $75 million exploit of Tectonic on Cronos in August and a roughly $9 million attack on Hedera-based Bonzo Lend in July.
