Kava Lend Hacked, Loses $3.76M Amid Collateral Surge

Kava Lend Suffers Massive Exploit, Millions in KAVA Drained

The native lending protocol on the Kava blockchain, Kava Lend, was drained of its assets on Saturday night. An attacker exploited a vulnerability, using a minuscule BUSD loan to inflate the value of dormant collateral by 243,000 times. The attacker then proceeded to borrow 55.2 million KAVA tokens in 127 separate transactions, causing the token’s price to plummet by 59% in 24 hours.

Exploit Details Unfold

The attack on Kava Lend began late Saturday, November 14th. The perpetrator initiated the exploit by borrowing a tiny amount of BUSD, effectively pushing the net supply of the stablecoin market to near zero. This manipulation caused the protocol to recognize the attacker’s deposited assets as astronomically valuable within three minutes. Subsequently, the attacker withdrew approximately 55.2 million KAVA tokens across 127 transactions.

At the pre-attack price of $0.068 per KAVA, the stolen tokens were worth approximately $3.76 million on paper. The protocol’s module account, which held collective deposits, saw its balance drop from 55.33 million KAVA to a mere 0.19 KAVA within an hour and a half.

KAVA Token Price Collapses

The KAVA token price mirrored the exploit’s impact, falling sharply after the news broke. At the time of reporting, KAVA was trading at $0.0276, a 59.3% decrease over 24 hours, with a 24-hour low of $0.02507. Compared to its pre-attack price of $0.068, holders have experienced paper losses exceeding the value of the stolen assets.

The Mechanics of the Attack

On-chain data indicates the attack commenced at 23:01 UTC on Friday. The attacker first borrowed a minimal amount of BUSD, reducing Kava Lend’s BUSD market net supply to one two-hundred-millionth of a dollar.

Kava Lend calculates its deposit certificate prices based on market net supply and interest rate models. When the denominator in this calculation approaches zero, the protocol erroneously inflated the value of every BUSD deposit by approximately 243,000 times within three minutes. This allowed the attacker’s initial BUSD deposit to be recognized as collateral worth around $1.25 billion BUSD.

This logic for interest and exchange rate calculations is publicly available in Kava’s open-source code, meaning anyone could have calculated the point at which the exchange rate would become uncontrollable by manipulating net supply. With this artificially inflated collateral, the attacker initiated 127 KAVA loan transactions. A second account was then used to repay these loans individually, circumventing the protocol’s limit on the total amount of KAVA that could be borrowed.

On-chain activity suggests this was not a spontaneous act. A recurring cycle of deposits and loans within the same market was observed starting November 8th, indicating the attacker had been preparing for at least a week.

Asset Liquidation and Recovery

Following the exploit, the attacker transferred approximately 49.2 million KAVA tokens via Kava’s LayerZero cross-chain bridge to an address on the BNB Chain. Within an hour, nearly all of these tokens were sold, yielding 3,006.5 BNB and 231,557 USDT, totaling approximately $2.09 million. The BNB has since been moved.

An additional 4.58 million KAVA tokens were sent to five unmarked addresses on the Kava chain. The actual cash-out rate was approximately 56%, with the initial paper value of $3.76 million yielding about $2.09 million.

Kava’s Response and Ongoing Investigation

Kava issued its first public response on Saturday at 7:28 PM Taiwan time, over seven hours after the attack began. The initial statement indicated they were “tracking unexpected behavior originating from a dApp within the Kava ecosystem.”

Roughly thirty minutes later, the team added that they were aware of the KAVA cross-chain activity and subsequent sell-off on BSC, emphasizing that “this is not an infinite minting event. The incident has been isolated and contained within Kava Lend.” At 9:05 AM, Kava announced the precautionary suspension of the Axelar cross-chain bridge, promising a full incident report upon completion. Partner exchanges also temporarily halted KAVA deposits and withdrawals.

Kava has not yet provided an official figure for the total losses or released a post-mortem analysis, characterizing the incident as “a developing situation.”

Underlying Vulnerabilities and Precedent

Following regulatory action against BUSD issuer Paxos in 2023, which halted new BUSD issuance, many lending protocols saw their BUSD markets become largely inactive, with minimal deposit, borrowing, or liquidation activity.

In markets with little to no trading, net supply can be driven to extremely low levels. Crucially, the protocol’s exchange rate calculations do not automatically deactivate due to a lack of user activity. Kava Lend’s exploit exploited this loophole: the attacker did not need to persuade anyone or breach cryptography; by simply driving the net supply of an unmonitored market to near zero, they could dictate the value of their collateral.

Similar incidents have occurred repeatedly over the past year. In August, Cronos-based Tectonic lost $75 million due to manipulation of its governance token price. In July, Bonzo Lend on Hedera saw $9 million borrowed with only a few dollars in collateral. Balancer V1 experienced a precision vulnerability in late August. The common thread in these events is the manipulation of calculation components where the “denominator is driven to a minimum,” rather than private key compromises.

Key Questions Remain

Several critical questions remain unanswered. Firstly, the discrepancy between the publicly accounted for 53.78 million KAVA (in two known destinations) and the 55.2 million KAVA withdrawn leaves approximately 1.4 million KAVA unaccounted for. The official incident report will be crucial in clarifying the final loss figure.

Secondly, compensation remains a concern. Kava Lend’s depositors are primarily stablecoin holders, and such protocols typically lack deposit insurance. Losses are ultimately absorbed by depositors or the protocol’s treasury. The team has not yet outlined any compensation arrangements.

Thirdly, the vulnerability of other dormant markets is a significant concern. Beyond BUSD, several other stablecoin markets, which have also ceased new issuance but remain active in lending protocols, could be susceptible. If similar net supply manipulations can be achieved with a single small loan, further exploits may be imminent.