An exploit on Kava Lend, the lending protocol on the Kava blockchain, drained approximately 55.2 million KAVA tokens worth around $3.76 million at the time of the attack, according to on-chain data analyzed by The Block. The Kava team stated the incident is limited to Kava Lend and was not caused by unlimited token minting. As of publication, the team had not released an official loss estimate or a full technical post-mortem.
An Inactive BUSD Market Was the Entry Point
The vulnerability appears to have originated in Kava Lend’s BUSD market, tied to the stablecoin that Paxos stopped issuing in 2023. According to The Block’s reconstruction of on-chain activity, the attacker manipulated the deposit value in that market and borrowed KAVA using artificially inflated collateral. The operation was reportedly repeated 127 times, circumventing the protocol’s borrowing limits each time.
A portion of the drained tokens was then bridged to BNB Chain via LayerZero and sold. The Block’s on-chain data indicates that approximately 49.2 million KAVA were bridged and exchanged for around $2.1 million in BNB and USDT. These figures come from on-chain data analysis: the final loss total and the full path of the funds will need confirmation from the team’s forthcoming technical report.
KAVA Dropped Nearly 40% Following the Attack
The news weighed heavily on KAVA’s price, which fell by close to 40% after the attack was disclosed, according to The Block. That price drop reflects immediate market reaction to the incident, though it does not alone measure the protocol’s actual losses or the potential impact on individual depositors.
The case puts a spotlight on the risks that decentralized lending markets face when they keep low-utilization or legacy-asset markets active. Protocol security depends heavily on how interest accrual, collateral valuation, and borrowing caps are calculated: a logic flaw in one market can cascade into losses for depositors across the entire system.
Kava described the incident as contained within Kava Lend and ruled out an “infinite mint” scenario, but significant questions remain. How was it possible to inflate deposit values so substantially? Are any other funds at risk? The immediate priority for the team is publishing a rigorous technical analysis, quantifying losses with precision, and laying out concrete steps to prevent a similar vulnerability from being exploited again.
