Kava Lend loses roughly $3.8 million to hack, sending KAVA token down nearly 40%

Onchain data shows an attacker borrowed out nearly all of Kava Lend's KAVA, worth about $3.76 million before the attack, then bridged most of it to BNB Chain and sold it for roughly $2.1 million.

An attacker drained about 55.2 million KAVA tokens from Kava Lend, the native lending protocol of Layer 1 blockchain Kava KAVA-45.92%, late Friday after inflating the value of deposits in a dormant stablecoin market and borrowing against them, according to onchain data reviewed by The Block.

The tokens were worth roughly $3.76 million at the $0.068 price KAVA traded at before the attack. Kava Lend's module account, where the protocol's pooled deposits sit, went from holding 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half.

"We are tracking unexpected behavior originating from a dApp within the Kava ecosystem," Kava wrote on X at 6:28 a.m. ET on Saturday in its first public acknowledgment of the incident, more than seven hours after the attack started.

In a follow-up post about half an hour later, Kava said it was aware of "the bridging and sale of KAVA tokens on BSC." "To clarify: This is not an infinite mint," the team wrote. "The event is isolated and contained within Kava Lend."

Kava hasn't put an official number on the losses or published a post-mortem report of the attack.

Attack targeted dormant stablecoin market

The exploit ran through Kava Lend's market for BUSD, the Binance-branded stablecoin that issuer Paxos stopped minting in 2023. The market was all but empty ahead of the attack, onchain data shows.

Kava Lend works out what depositors have earned by dividing the interest borrowers pay by the market's net supply, per Kava's public source code. The code skips the division if that supply figure is exactly zero; however, it doesn't check for figures that are minute, but still above zero.

At 11:01 p.m. ET on Friday, the attacker used a small BUSD loan to bring the market's net supply down to two hundred-millionths of a dollar. Over the next three minutes, Kava Lend multiplied the value of every BUSD deposit roughly 243,000-fold. That included BUSD the attacker had deposited ahead of time, which the protocol now counted as roughly 1.25 billion BUSD in collateral.

The attacker then borrowed KAVA against their deposit 127 times, using a second account to clear each loan and get around Kava Lend's cap on KAVA borrowing. The attacker appears to have prepared for at least a week, running repeated deposit and borrow cycles in the BUSD market from Nov. 8.