Kava Lend Exploit Drains Millions as KAVA Falls 47%

An exploit emptied almost all the $KAVA from Kava Lend’s lending pool, according to onchain analysis by The Block, while the token fell nearly 47% over 24 hours. Kava paused withdrawals through its Axelar bridge, and three Korean exchanges suspended $KAVA transfers.

The attacker borrowed about 55.2 million $KAVA, worth roughly $3.8 million at pre-attack prices, after inflating deposits in a little-used $BUSD stablecoin market, The Block reported. That dollar estimate values the borrowed tokens before the sell-off; it is not the amount realized from selling them.

$KAVA traded at about $0.0362 on CoinGecko’s aggregated market feed, down 46.6% over the preceding 24 hours as of 7:12 p.m. ET on Nov. 14.

Kava said the incident was “isolated and contained within Kava Lend” and “not an infinite mint.” The distinction matters: the reported attack took existing tokens from a lending pool rather than creating an unlimited supply of new $KAVA. It does not mean lenders can recover their deposits.

Inflated Collateral Emptied the Pool

Kava Lend lets users deposit assets to earn interest and borrow against collateral. According to The Block’s analysis, an attacker pushed the $BUSD market’s net supply close to zero, causing its interest calculation to inflate the value of deposits roughly 243,000-fold. The attacker then used the inflated collateral to borrow $KAVA repeatedly.

Kava’s public source code divides newly earned interest by cash plus outstanding loans minus reserves. It skips that division when the denominator is exactly zero, but not when it is a tiny positive number.

Blockchain data provider Bitquery’s separate investigation described a second part of the exploit: a helper wallet borrowed $KAVA, then liquidations closed its loans even though almost no $BUSD remained to cover them. That reopened room under the borrowing cap, allowing the process to repeat 127 times.

Bitquery put gross borrowing at 55.2 million $KAVA, but said the two wallets kept 53.9 million after repaying other borrowers’ loans—about $3.7 million at the pre-sale price. Bitquery’s analysis found that existing pool assets funded the attack, consistent with Kava’s description of the incident as “not an infinite mint.”

The Block reported that about 49.2 million $KAVA crossed to BNB Chain through LayerZero, where most was sold for roughly $2.1 million. That was a different bridge from Axelar, whose withdrawals Kava subsequently paused.

For lenders, the damage is a liquidity shortfall, not just a falling token price. Bitquery said the pool owed lenders about 55.2 million $KAVA but held only 0.19 $KAVA when it checked on Nov. 14. It also warned that the attacker’s inflated $BUSD claim remained outstanding, leaving subsequent $BUSD deposits exposed to withdrawal by that wallet. Those findings reflect its snapshot, not a completed Kava incident report.

Which Transfers Are Frozen?

Upbit suspended $KAVA deposits and withdrawals on Nov. 14, citing signs of a security incident. It separately issued a trading caution, warning of heightened volatility.

Bithumb’s suspension was scheduled for 5:35 a.m. ET that day, followed by Coinone’s at 5:40 a.m. ET. Bithumb said trading would remain available during the transfer freeze; Coinone said other services were unaffected unless separately announced.

At 9:05 a.m. ET, Kava announced that cross-chain asset withdrawals through Axelar were paused as a precaution. The team said it would publish a complete incident report once ready.