Kava-Lend-Exploit zieht KAVA im Wert von 3,8 Millionen US-Dollar ab – Token stürzt um fast 50 % ab

CryptoPress · 2026-11-15T09:35:55.000Z

Ein Angreifer lieh sich über Kava Lend rund 55,2 Millionen KAVA im Wert von etwa 3,76 Millionen US-Dollar vor dem Angriff, indem er die Einlagen in einem inaktiven BUSD-Markt um etwa das 243.000-Fache aufblähte.Etwa 49,2 Millionen KAVA wurden über LayerZero auf die BNB Chain transferiert und für rund 2,1 Millionen US-Dollar in BNB und USDT verkauft.Der KAVA-Token fiel um fast 50 % auf ein Rekordtief von rund 0,036 US-Dollar. Kava setzte unterdessen die Axelar-Bridge aus, und Börsen stellten Transfers ein.Ein Angreifer zog am späten Freitag nahezu alle verfügbaren KAVA aus dem Kava-Lend-Protokoll ab. Laut einer On-Chain-Analyse lieh er sich Token im Wert von rund 3,76 Millionen US-Dollar zum Preis von 0,068 US-Dollar vor dem Angriff – insgesamt etwa 55,2 Millionen –, nachdem er die Sicherheiten in einem inaktiven BUSD-Markt künstlich aufgebläht hatte.

An attacker borrowed roughly 55.2 million KAVA, valued at about $3.76 million pre-attack, from Kava Lend by inflating deposits in a dormant BUSD market roughly 243,000-fold.
Approximately 49.2 million KAVA was bridged to BNB Chain via LayerZero and sold for about $2.1 million in BNB and USDT.
The KAVA token fell nearly 50% to record lows near $0.036, while Kava paused the Axelar bridge and exchanges suspended transfers.
An attacker drained nearly all available KAVA from the Kava Lend protocol late Friday, borrowing about 55.2 million tokens worth roughly $3.76 million at the pre-attack price of $0.068 after artificially inflating collateral in a dormant BUSD market, according to on-chain analysis.
The exploit targeted an arithmetic flaw in the interest accrual logic of the idle BUSD market, which had seen little activity since 2023. By driving the net supply near zero, the attacker caused deposit values to surge approximately 243,000 times within minutes, then used the inflated collateral to borrow KAVA across 127 transactions while employing a second account to liquidate loans and bypass borrowing limits. The protocol’s module account, which held 55.33 million KAVA, was reduced to just 0.19 KAVA in roughly 90 minutes, as detailed in the Bitquery investigation.
Beginning early Saturday, the attacker bridged about 49.2 million KAVA to BNB Chain through the LayerZero bridge and sold most of it within an hour for 3,006.5 BNB and 231,557 USDT, realizing approximately $2.09 million. A portion of proceeds, including 612,416 USDT, was later blocked at the Relay bridge. Kava addressed the incident in a post on X, stating: “To clarify: This is not an infinite mint. The event is isolated and contained within Kava Lend.”
Partner exchanges, including Upbit, Bithumb and Coinone, paused KAVA deposits and withdrawals as a precaution. Kava also suspended cross-chain withdrawals through the Axelar bridge, promising a full incident report. The KAVA token plunged nearly 50% in 24 hours to all-time lows near $0.036, far outpacing broader market declines, with trading volume surging as the sell-off hit thin liquidity on BNB Chain.
Lenders face a severe liquidity shortfall, as the pool now owes far more KAVA than it holds in available assets. The incident underscores risks in dormant markets within lending protocols, where near-zero supply can trigger extreme index manipulations without creating new tokens. Kava has not yet detailed user restitution or a precise timeline for protocol recovery.