Community Trust ScoreLikely Real
An attacker withdrew 55.2 million KAVA tokens from the Kava Lend lending protocol late Friday, an event that reduced the value of the token by approximately 39% in the following 24 hours. The stolen assets were valued at roughly $3.76 million based on the pre-attack price of $0.068 per KAVA. At the time of publication, KAVA was trading near $0.042.
More coverage is filed under Technology.
The BUSD Collateral Flaw
The exploit targeted the BUSD market within Kava Lend, the native lending protocol of the Kava Layer 1 blockchain. BUSD is a stablecoin branded by Binance, with Paxos serving as its issuer until the company ceased minting the asset in 2023. Prior to the attack, the BUSD market on the protocol was largely inactive. The vulnerability exploited a specific coding behavior in Kava Lend’s module account. The code is designed to skip a division operation if the net supply of an asset is exactly zero, but it fails to account for minute figures that are above zero.
At 11:01 p.m. ET on Friday, the attacker initiated the exploit by using a small BUSD loan to drive the market’s net supply down to two hundred-millionths of a dollar. In the three minutes that followed, the protocol’s calculation error multiplied the value of every BUSD deposit in the market by a factor of 243,000. As a result, the system recognized the attacker’s pre-deposited BUSD as collateral worth approximately 1.25 billion BUSD. This inflated collateral allowed the attacker to borrow KAVA tokens 127 times. To circumvent the protocol’s cap on KAVA borrowing, the attacker used a second account to clear each individual loan immediately after it was taken out.
Execution and Fund Movement
Kava Lend’s module account, which held 55.33 million KAVA prior to the incident, was left with only 0.19 KAVA within a little over an hour and a half. The attacker appears to have prepared for the exploit for at least a week, running repeated deposit and borrow cycles starting on Nov. 8. Following the drain, the attacker began moving the assets. Beginning at 4:59 a.m. ET on Saturday, approximately 49.2 million KAVA were bridged from the Kava network to the BNB Chain using Kava’s LayerZero bridge.
Most of the bridged KAVA was sold within an hour. The sale generated proceeds of 3,006.5 BNB and 231,557 USDT, with a combined value of $2.09 million. The BNB proceeds have since been moved to other addresses. Additionally, roughly 4.58 million KAVA were sent to five unlabeled addresses directly on the Kava network. Kava issued its first public acknowledgment of the incident at 6:28 a.m. ET on Saturday, more than seven hours after the attack had begun. The company stated it was tracking unexpected behavior originating from a dApp within the Kava ecosystem, specifically noting the bridging and sale of KAVA tokens on BSC.
Protocol Response and Market Impact
In response to the security breach, Kava paused the Axelar bridge at 9:05 a.m. ET, although the majority of the drained KAVA had already left the network via LayerZero. Partner exchanges paused deposits and withdrawals as a standard precautionary measure. Kava clarified that the event was not an infinite mint and that the incident was isolated and contained within Kava Lend. The company indicated it would share a complete incident report as soon as it is ready, emphasizing that actions were taken out of an abundance of caution. The KAVA token price fell from $0.068 to $0.042, a 39% drop over the 24-hour period following the exploit. Similar incidents have affected other networks, including Cronos, which halted its network in August after an exploit of the Tectonic lending protocol estimated at $75 million, and Hedera’s Bonzo Lend, which suffered a loss of roughly $9 million in July.
