Kava’s native lending protocol, Kava Lend, was drained on Saturday night. The attacker used a tiny BUSD loan to inflate the collateral value in a dormant market by 243,000 times, then borrowed 55.2 million KAVA in 127 transactions. The token plunged 59% in 24 hours. （Previous coverage: Cronos halts operations in emergency! Tectonic governance token manipulated, used to drain $75 million after a 100-fold surge in half an hour） （Background: Bonzo Lend hit by oracle attack! A few dollars’ worth of collateral used to borrow $9 million in USDC + HBAR）   Lending protocol Kava Lend was attacked last night (the 14th). The attacker first took out a tiny BUSD loan, pushing the net supply in the long-dormant stablecoin market close to zero. This caused the protocol to value the attacker’s deposit at an astronomical amount within three minutes. The attacker then borrowed around 55.2 million KAVA in 127 transactions. At the pre-attack price of $0.068 per token, the tokens were worth around $3.76 million on paper. Meanwhile, the module account holding the protocol’s pooled deposits fell from 55.33 million tokens to just 0.19 in an hour and a half. The token price collapsed as well. KAVA continued to fall after news of the incident broke, trading at $0.0276 at the time of writing, down 59.3% over 24 hours, with a 24-hour low of $0.02507. Compared with the pre-attack price of $0.068, holders’ paper losses from the incident already exceed the amount stolen. KAVA/USDT price movement over the past 48 hours (Source: Binance; chart by BlockTempo) Collateral inflated 240,000-fold in three minutes According to the on-chain timeline, the attack began at 23:01 on Friday, US time. The attacker first took out a tiny BUSD loan, reducing the net supply in Kava Lend’s BUSD market to just “one two-hundred-millionth of a dollar.” The price of Kava Lend deposit receipts is calculated based on the market’s net supply and interest rate model. Once the denominator was pushed close to zero, the protocol inflated the value of every BUSD deposit by around 243,000 times over the next three minutes. The BUSD the attacker had deposited beforehand was thus valued as roughly 1.25 billion BUSD in collateral. The interest and exchange-rate calculation logic is publicly available in Kava’s open-source code. Anyone could calculate in advance how low the net supply would need to fall for the exchange rate to spiral out of control. With this collateral inflated out of thin air, the attacker made 127 consecutive KAVA loan requests, then used a second account to repay them one by one, bypassing the protocol’s cap on total KAVA borrowing. On-chain activity suggests this was no spur-of-the-moment attack: repeated deposit-and-borrow loops had appeared in the same market since November 8, meaning the attacker had prepared for at least a week. 49.2 million KAVA bridged to BNB Chain and sold off within an hour Next, the attacker used Kava’s LayerZero bridge to transfer around 49.2 million KAVA to an address on BNB Chain, then sold nearly all of it within an hour, receiving 3,006.5 BNB and 231,557 USDT, worth a total of around $2.09 million. The BNB has since been transferred away. Another roughly 4.58 million KAVA went to five unlabeled addresses on the Kava chain. The attacker converted $3.76 million in on-paper value into around $2.09 million in cash, for an actual realization rate of roughly 56%. Official response: No unlimited minting; full report not yet available Kava did not issue its first public response until 7:28 p.m. Taiwan time on Saturday, more than seven hours after the attack began. It said it was “tracking unexpected behavior originating from a dApp within the Kava ecosystem.” About half an hour later, the team added that it was aware of the cross-chain transfer and sell-off of KAVA on BSC, stressing that “this is not an unlimited mint; the incident has been isolated and contained within Kava Lend.” At 9:05 a.m., Kava announced that it had also paused the Axelar bridge as a precaution, and said a full incident report would be published once complete. Partner exchanges also suspended KAVA deposits and withdrawals. We are tracking unexpected behavior originating from a dApp within the Kava ecosystem. Our teams are investigating with high priority – stand by for an official update shortly. — Kava (@KAVA_CHAIN) November 14, 2026 As of publication, Kava has not provided an official loss figure or published a postmortem, describing the incident only as “an evolving situation.” Dormant markets become unguarded side doors After BUSD’s issuer was ordered by US regulators to stop issuing new tokens in 2023, BUSD markets on most lending protocols were left with only existing funds circulating within them. Deposits, borrowing, and liquidations largely ground to a halt. When a market has no trading activity, its net supply can fall to extremely low levels, but a protocol’s exchange-rate calculation does not automatically disable itself just because “nobody is using this market.” That is precisely the vulnerability Kava Lend ran into: the attacker didn’t need to convince anyone or break cryptography. They only had to drive the net supply in an unmonitored market to zero to determine the value of their own collateral. Similar incidents have repeatedly occurred over the past year. In August, Tectonic on Cronos was exploited through manipulation of its governance token price, draining $75 million. In July, Bonzo Lend on Hedera was used to borrow $9 million against a few dollars’ worth of collateral. At the end of August, Balancer V1 disclosed a precision vulnerability. The common thread was a calculation step where “the denominator was pushed extremely low,” not leaked private keys. What to watch next First, the discrepancy. The two publicly known destinations account for a total of 53.78 million tokens, leaving around 1.4 million unaccounted for compared with the 55.2 million withdrawn. Whether the official incident report fills in this gap will determine the final loss figure. Second, compensation. Kava Lend depositors mainly hold stablecoins, and protocols of this kind have no deposit insurance. Losses will ultimately be absorbed by depositors or recognized by the protocol’s treasury. The team has not mentioned any compensation plans so far. Third, other dormant markets. Besides BUSD, several stablecoins that stopped being issued long ago remain in lending protocols. If a single small loan can similarly push their net supply close to zero, another protocol drain could happen. Related coverage 1 satoshi swaps out an entire pool’s assets! Precision bug in Balancer V1 liquidity pool causes $230,000 in losses Term Finance loses $8.5 million to governance exploit: seven-day timelock and LP veto both fail Cross-chain bridge hit again! Allbridge Core loses $1.65 million in flash-loan attack ... This article, “KAVA crashes 59%! Kava Lend hacked and drained of $3.76 million as collateral inflates 240,000-fold,” was first published on BlockTempo (the most influential blockchain news media).