Kava Lend, the native lending protocol on the Kava blockchain, was attacked on 11/14. According to The Block’s on-chain analysis, the attacker borrowed nearly all the KAVA in the protocol—about 55.2 million tokens, worth roughly $3.76 million at the pre-attack price of about $0.068.$KAVA On Binance spot, KAVA fell about 58% in 24 hours, from around $0.068 to about $0.028 (around 16:00 Taipei time on 11/15), with an intraday low of about $0.025.
1. How did the attack happen? (According to The Block, 0xCERT, and Bitquery)
The vulnerability was in Kava Lend’s BUSD market. BUSD is a Binance-branded stablecoin that Paxos stopped minting in 2023, and almost nobody used this market.
The attacker first deposited BUSD, then took out a small BUSD loan, pushing the market’s net supply down to about $0.00000002. The code skipped division only when supply was “exactly equal to 0,” but didn’t handle cases where it was “extremely small but greater than 0.”
Within three minutes, the value of each BUSD deposit was inflated by about 243,000 times, and the attacker’s deposit was counted as roughly 1.25 billion BUSD worth of collateral.
The attacker borrowed KAVA against this “bloated” collateral in 127 transactions, using a second account to repay each loan and bypass KAVA’s borrowing limit. The protocol module account went from about 55.33 million KAVA to just 0.19 KAVA in roughly an hour and a half.
The Block reported that the attacker had been repeatedly testing the deposit-and-borrow process in this BUSD market since 11/8, preparing for at least a week.
II. Where the stolen funds went
• About 49.2 million KAVA was transferred to BNB Chain via Kava’s LayerZero cross-chain bridge, then sold within an hour for 3,006.5 BNB and 231,557 USDT, worth about $2.09 million in total. Another roughly 4.58 million KAVA was sent to five unlabelled addresses on Kava (The Block).
• DefiLlama (cited by 0xCERT) reported that about 612,416 USDT was intercepted at the Relay cross-chain bridge. Bitquery traced most of the funds to Hyperliquid later on.
• Figures vary slightly across sources. Kava has not yet announced an official loss amount or published a postmortem report.
III. Response from the project and exchanges
• Kava said this was “not an unlimited mint” and that the incident was “limited to Kava Lend.”
• Kava paused withdrawals from the Axelar cross-chain bridge, while partner exchanges suspended KAVA deposits and withdrawals. According to 0xCERT, three South Korean exchanges suspended KAVA transfers.
IV. Lessons worth remembering
• “An old, unused market” is still an attack surface: when a protocol delists or disables an asset, residual calculation logic may still be exploited if the market is merely left idle instead of being properly shut down.
• Edge cases: checking only whether a value “equals 0” without handling values “approaching 0” is a common precision risk in DeFi lending protocols.
• If you hold related tokens, rely on official announcements from Kava, check the deposit and withdrawal status on exchanges, and beware of phishing links impersonating “compensation claims.”
Sources:
• The Block: Kava Lend loses roughly $3.8 million to hack, sending KAVA token down nearly 40% (2026/11/14)
• 0xCERT security advisory 0xCERT-2026-0352
• Bitquery: Kava Hack: 55.2M Coins Drained, $612K Blocked at Relay
• TokenPost: Attackers Borrow 55.2 Million KAVA in Kava Lend Exploit
• Official Kava X statement (reposted by Tree News)
• Binance spot market data API (KAVAUSDT 24h, daily candlesticks)
#Kava #KavaLend #DeFi #Cybersecurity #駭客
⚠️ This article is for informational purposes only and is not investment advice (NFA). Cryptocurrency markets are highly volatile. Do your own research (DYOR) and be aware of the risks.