Kava Lend loses roughly $3.8 million to hack, sending KAVA token down nearly 40%

An attacker drained about 55.2 million KAVA tokens from Kava Lend, the native lending protocol of Layer 1 blockchain Kava (KAVA), late Friday after inflating the value of deposits in a dormant stablecoin market and borrowing against them, according to onchain data reviewed by The Block.

The tokens were worth roughly $3.76 million at the $0.068 price KAVA traded at before the attack. Kava Lend's module account, where the protocol's pooled deposits sit, went from holding 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half.

"We are tracking unexpected behavior originating from a dApp within the Kava ecosystem," Kava wrote on X at 6:28 a.m. ET on Saturday in its first public acknowledgment of the incident, more than seven hours after the attack started.

In a follow-up post about half an hour later, Kava said it was aware of "the bridging and sale of KAVA tokens on BSC." "To clarify: This is not an infinite mint," the team wrote. "The event is isolated and contained within Kava Lend."

Kava hasn't put an official number on the losses or published a post-mortem report of the attack.

Attack targeted dormant stablecoin market

The exploit ran through Kava Lend's market for BUSD, the Binance-branded stablecoin that issuer Paxos stopped minting in 2023. The market was all but empty ahead of the attack, onchain data shows.

Kava Lend works out what depositors have earned by dividing the interest borrowers pay by the market's net supply, per Kava's public source code. The code skips the division if that supply figure is exactly zero; however, it doesn't check for figures that are minute, but still above zero. 

At 11:01 p.m. ET on Friday, the attacker used a small BUSD loan to bring the market's net supply down to two hundred-millionths of a dollar. Over the next three minutes, Kava Lend multiplied the value of every BUSD deposit roughly 243,000-fold. That included BUSD the attacker had deposited ahead of time, which the protocol now counted as roughly 1.25 billion BUSD in collateral.

The attacker then borrowed KAVA against their deposit 127 times, using a second account to clear each loan and get around Kava Lend's cap on KAVA borrowing. The attacker appears to have prepared for at least a week, running repeated deposit and borrow cycles in the BUSD market from Nov. 8.

Attacker sold loot on BNB Chain

Beginning at 4:59 a.m. ET on Saturday, the attacker bridged about 49.2 million KAVA to an address on BNB Chain through Kava's LayerZero bridge. Most of it was sold within the hour for 3,006.5 BNB and 231,557 USDT, worth about $2.09 million combined, and the BNB has since been moved out. Another roughly 4.58 million KAVA went to five unlabeled addresses on Kava.

KAVA was trading near $0.042 at time of publication, down about 39% over the past 24 hours, according to The Block's Kava Price page. Partner exchanges paused deposits and withdrawals "as a standard precautionary measure," Kava said.

At 9:05 a.m. ET, Kava said it had paused the Axelar bridge "out of an abundance of caution," though the drained KAVA left the network through LayerZero. "We will share a complete incident report as soon as it is ready," the team wrote.

The Kava incident follows several lending protocol exploits this year where an attacker borrowed against collateral worth far less than the protocol believed. Cronos halted its network in August after an exploit of lending protocol Tectonic estimated at $75 million, and Hedera's Bonzo Lend was hit for roughly $9 million in July.

This is a developing story.