Onchain records indicate that an exploit participant borrowed nearly all of Kava Lend’s KAVA supply, which valued around $3.76 million before the breach, before transferring the majority across to BNB Chain and liquidating it for roughly $2.1 million.
An infiltrator extracted about 55.2 million KAVA tokens from Kava Lend—the core borrowing platform of the Layer 1 network Kava (KAVA)—late Friday after inflating deposit values within an inactive stablecoin pool and taking out loans against them, based on blockchain analysis examined by The Block.
Those digital assets were valued at approximately $3.76 million given the $0.068 rate KAVA commanded prior to the security breach. The module account of Kava Lend, which houses pooled user funds, plummeted from holding 55.33 million KAVA down to just 0.19 KAVA in a span slightly exceeding ninety minutes.
“We are tracking unexpected behavior originating from a dApp within the Kava ecosystem,” Kava stated on X at 6:28 a.m. Eastern Time on Saturday for their initial public confirmation of the event, more than seven hours following the onset of the exploit.
Within a subsequent statement roughly half an hour afterward, Kava acknowledged they were cognizant of “the bridging and sale of KAVA tokens on BSC.” “To clarify: This is not an infinite mint,” the developers posted. “The event is isolated and contained within Kava Lend.”
Kava has not yet assigned a definitive figure to the financial damages nor published an official post-mortem analysis regarding the breach.
Attack targeted dormant stablecoin market
The malicious activity exploited Kava Lend’s liquidity pool for BUSD, the Binance-associated stablecoin whose issuer Paxos ceased creating in 2023. Blockchain records reveal that the market was essentially vacant prior to the breach.
Kava Lend calculates what lenders earn by dividing interest paid by borrowers by the net supply of the market, according to Kava’s public codebase. The software bypasses the division step when that supply metric equals precisely zero; however, it fails to evaluate metrics that are negligible yet remain above zero.
At 11:01 p.m. ET on Friday, the malicious actor utilized a modest BUSD loan to push the market net supply down to two hundred-millionths of a dollar. Over the subsequent three minutes, Kava Lend magnified the worth of every BUSD deposit by roughly 243,000 times. This included BUSD that the attacker had previously deposited, which the protocol now evaluated as roughly 1.25 billion BUSD worth of collateral.
The infiltrator subsequently borrowed KAVA against their deposited assets 127 times, employing a secondary wallet to settle each loan and bypass Kava Lend’s restrictions on KAVA borrowing limits. The perpetrator appeared to have prepared for at least a week, executing recurrent deposit and borrowing sequences within the BUSD market starting November 8.
Attacker sold loot on BNB Chain
Commencing at 4:59 a.m. ET on Saturday, the exploiter transferred about 49.2 million KAVA to an address on BNB Chain utilizing Kava’s LayerZero bridge. The vast majority was liquidated within the hour for 3,006.5 BNB alongside 231,557 USDT, totaling roughly $2.09 million combined, with the BNB having since been relocated. An additional approximate 4.58 million KAVA migrated to five untagged addresses on Kava.
KAVA traded near $0.042 at the time of writing, marking a decline of about 39% over the preceding 24 hours, according to The Block’s Kava Price dashboard. Associated trading platforms halted deposits and withdrawals “as a standard precautionary measure,” Kava noted.
At 9:05 a.m. ET, Kava announced it had suspended the Axelar bridge “out of an abundance of caution,” despite the stolen KAVA having exited the network via LayerZero. “We will share a complete incident report as soon as it is ready,” the project team stated.
The Kava security breach succeeds multiple borrowing platform hacks this year where a bad actor secured loans backed by collateral worth substantially less than the system assumed. Cronos suspended its network in August following an exploit of the Tectonic lending protocol valued at an estimated $75 million, while Hedera’s Bonzo Lend suffered an approximate $9 million loss in July.
This is a developing story.
Originally published at https://www.theblock.co/news/defi/2026-11-14-kava-lend-loses-roughly-3-8-million-to-hack-sending-kava-token-down-nearly-40-440350.
