Kava Lend hack explained: how $3.7M was stolen

On November 14, attackers found an arithmetic flaw in the Kava Lend money market and drained about 53.9 million KAVA, worth roughly $3.7 million before the price collapsed (DefiLlama). Most of the tokens were bridged to BNB Chain and sold there, and KAVA lost more than 40% within a day.

What we know now

• Kava confirmed the problem is isolated to Kava Lend and "not an infinite mint" of KAVA (Kava on X). The team says it will publish a complete incident report "as soon as it is ready," with no date given.
• About 53.9M KAVA was stolen, roughly $3.7M at pre-crash prices (DefiLlama). Crypto Briefing and AirdropAlert put the amount bridged to BNB Chain at about 48.36M KAVA, or $3.2M–$3.3M (AirdropAlert).
• The Relay bridge blocked about 612,000 USDT of the attackers' proceeds (DefiLlama).
• The Axelar bridge on Kava is paused, so withdrawals through it are halted (Kava on X). Upbit, Bithumb and Coinone suspended KAVA deposits and withdrawals, and Upbit added the token to its delisting watchlist (Crypto Briefing).
• Attacker addresses, a compensation plan and statements from security firms such as PeckShield, CertiK or Cyvers had not been published at the time of writing.

How the exploit worked

Kava Lend is the lending market of the Kava chain: users post collateral and borrow other assets against it. Each market tracks an "interest index," the multiplier by which a depositor's balance grows.

According to DefiLlama, the BUSD market had almost no supply left. The index is computed by dividing by that supply, and with such a tiny denominator an arithmetic error pushed it up about 243,000-fold. A small BUSD deposit turned into enormous collateral in the protocol's books. The attackers borrowed KAVA against it again and again, then ran liquidations in a way that wiped the debt without the protocol receiving real collateral to cover the loans. DefiLlama classifies the attack as an arithmetic error.

Kava has not yet confirmed this mechanism; there is no official post-mortem so far.

Timeline

• Nov. 14, 5:36 AM ET. Upbit suspended KAVA deposits and withdrawals; trading continued under a caution notice (BlockchainReporter).
• Nov. 14, 6:28 AM ET. Kava said it was tracking "unexpected behavior" from a dApp in its ecosystem and investigating with high priority (Kava on X).
• Nov. 14, 7:01 AM ET. Kava clarified that KAVA had been bridged to BSC and sold, but it was "not an infinite mint" and the event was contained within Kava Lend; partner exchanges paused deposits and withdrawals (Kava on X).
• Nov. 14, morning. Bithumb and Coinone also halted KAVA transfers (Crypto Briefing, TokenPost).
• Nov. 14, 9:05 AM ET. Kava paused the Axelar bridge and promised a complete incident report (Kava on X).
• Nov. 14, 12:10 PM ET. KAVA traded near $0.0395, down 41.9% in 24 hours, after an intraday low of $0.0364 versus the previous day's high of $0.0687 (BlockchainReporter).
• Nov. 14, afternoon. DefiLlama added the attack to its hacks database: $3.7M, 53.9M KAVA, an arithmetic error in the BUSD market (DefiLlama).

Where the money went

Most of the KAVA was bridged to BNB Chain and dumped on a decentralized exchange into thin liquidity (Crypto Briefing). Estimates differ: about 48.36M KAVA according to Crypto Briefing and AirdropAlert, versus 53.9M KAVA stolen in total according to DefiLlama. The gap may be tokens that never crossed the bridge, but the sources do not say.

The attackers then tried to move the proceeds on. The Relay bridge stopped about 612,416 USDT (DefiLlama). Neither Kava nor investigators have disclosed wallet addresses or transaction hashes yet.

What the team and exchanges did

• Kava: three posts on Nov. 14. It acknowledged the problem, said it was confined to Kava Lend, paused the Axelar bridge and promised a report (X). Nothing has been said about compensating affected users.
• Upbit: halted deposits and withdrawals, issued a caution notice and put KAVA on its delisting watchlist. It gave no date for resuming service, tying it to confirmed network stability (BlockchainReporter).
• Bithumb and Coinone: suspended KAVA deposits and withdrawals as a precaution (Crypto Briefing).
• Relay: blocked about 612,000 USDT (DefiLlama).

What it means for holders

While the Axelar bridge is paused, assets cannot leave the Kava chain through it. On the Korean exchanges, KAVA cannot be deposited or withdrawn, although it still trades. Upbit's watchlist means the token could be delisted if the exchange decides the risks are not resolved. Whether Kava Lend's losses will be covered, and by whom, is unknown until the team publishes its report. See the Kava coin page for prices and our first news story on the hack.

This is not investment advice.

This story is developing: we are following events and adding new information. Last updated Nov. 14, 4:15 PM ET.