An attacker drained about 55.2 million KAVA, worth roughly $3.76 million at the pre-attack price of $0.068, from Kava Lend, the lending protocol of the Kava blockchain, between late Friday 13 November and Saturday 14 November, according to on-chain data reviewed by The Block. The Kava Lend exploit went through a market nobody used any more, for BUSD, the Binance-branded stablecoin that Paxos stopped minting in 2023. A division check that only stopped at exactly zero let every BUSD deposit grow about 243,000-fold in three minutes, and the attacker borrowed KAVA against collateral that did not exist.
DefiLlama’s hacks database files the incident under “Arithmetic Error” and puts the haul a little lower, at about 53.9 million KAVA, or $3.7 million before the sell-off. Kava has not published a loss figure of its own. It has said a full incident report will follow, and none had appeared when The Block’s story ran at 23:07 UTC on Saturday.
The token paid for it. On Binance, KAVA went from $0.0681 at the close of the 09:00 UTC hour on Saturday to $0.0300 at 05:42 UTC on Sunday, a fall of 56%. On Coinbase, where far fewer tokens change hands, it stood at $0.0422 at 05:39 UTC, 38% below its pre-attack level.
How the Kava Lend exploit worked: a near-zero divisor in a dead market
Lending protocols do not rewrite every deposit each time interest is paid. They keep one running number per market, an index, and a deposit is worth its share multiplied by that index. When borrowers pay interest, the index rises by the interest divided by what is supplied in the market. With a normal market, the increase is tiny. With almost nothing supplied, the same arithmetic produces a huge number.
That is the hole the attacker used, as The Block describes it. At 11:01 p.m. ET on Friday (04:01 UTC on Saturday), a small BUSD loan pushed the BUSD market’s net supply down to two hundred-millionths of a dollar. Kava Lend’s interest code skipped the division only when supply was exactly zero, so it divided by the near-zero amount. Over the next three minutes, the value of every BUSD deposit rose about 243,000 times. BUSD the attacker had placed in the market beforehand was then counted as roughly 1.25 billion BUSD of collateral.
The preparation reportedly started on 8 November, with repeated deposit and borrow cycles. Against the inflated collateral, the attacker borrowed KAVA 127 times. The Block says a second account cleared each loan so the attacker could get around Kava Lend’s cap on KAVA borrowing. DefiLlama describes that step differently: the loans were liquidated through a process that erased the debt without recovering enough collateral. Either way, the protocol’s module account went from about 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half.
The flaw appears to sit in Kava’s own chain code rather than in an EVM smart contract. DefiLlama lists the vulnerable code as written in Go, the language Kava’s Cosmos SDK chain is built in, not Solidity, and The Block speaks of a “module account”. Kava has not confirmed it or said which part of its code failed.
Where the stolen KAVA went: LayerZero to BNB Chain, then BNB and USDT
From 4:59 a.m. ET on Saturday (09:59 UTC), about 49.2 million KAVA crossed to BNB Chain through LayerZero, according to The Block. Most of it was sold within the hour for 3,006.5 BNB and 231,557 USDT, worth about $2.09 million. That is an average near $0.042 per token, far below the $0.068 the tokens were worth on paper the night before: the attacker’s own selling crushed the price. Another 4.58 million KAVA went to five unlabelled addresses on Kava.
Part of the money has been stopped. DefiLlama says about 612,416 USDT of laundering proceeds was blocked at the Relay bridge. No report says who blocked it or whether it can go back to Kava Lend. For how these cross-chain routes work, see our entry on cross-chain bridges.
Kava’s response: more than seven hours, then an Axelar pause
Kava’s first public word came at 6:28 a.m. ET on Saturday (11:28 UTC), more than seven hours after the attack began, in a post on X saying it was tracking “unexpected behavior” from a dApp in its ecosystem, as quoted by The Block. A second post about half an hour later acknowledged the bridging and sale of KAVA on BSC. Kava also stressed that this was “not an infinite mint” and that the event was “isolated and contained within Kava Lend”.
At 9:05 a.m. ET (14:05 UTC), Kava said it had paused the Axelar bridge as a precaution. The drained KAVA had left by LayerZero, not Axelar. Kava also said unnamed partner exchanges had paused KAVA deposits and withdrawals as a “standard precautionary measure”. The Defiant reported that three Korean exchanges suspended transfers, without naming them.
Kava has not said whether users who supplied assets to Kava Lend will be compensated, whether it will offer the attacker a bounty, or whether borrowing on Kava Lend is paused. None of the published reports names a security firm that detected or traced the attack.
KAVA price by venue: Binance down 56%, Coinbase down 38%
The two main venues for KAVA tell different stories, so every figure below carries its exchange. The data comes from the public hourly and one-minute candles of Binance (KAVA/USDT) and Coinbase (KAVA/USD).
| Venue | Time (UTC) | KAVA price | Note |
|---|---|---|---|
| Coinbase | Sat 14 Nov, close of the 09:00 hour | $0.0678 | Last hour before the sell-off |
| Binance | Sat 14 Nov, close of the 09:00 hour | $0.0681 | Last hour before the sell-off |
| Coinbase | Sat 14 Nov, low of the 10:00 hour | $0.0439 | Bridging to BNB Chain starts at 09:59 |
| Binance | Sat 14 Nov, low of the 10:00 hour | $0.0438 | 105.9 million KAVA traded in the hour |
| Binance | Sat 14 Nov, low of the 11:00 hour | $0.0336 | Kava’s first post at 11:28 |
| Coinbase | Sat 14 Nov, low of the 12:00 hour | $0.0364 | Lowest Coinbase print since the attack |
| Binance | Sat 14 Nov, low of the 22:00 hour | $0.0251 | Lowest Binance print since the attack |
| Coinbase | Sun 15 Nov, 05:39 | $0.0422 | 38% below the pre-attack close |
| Binance | Sun 15 Nov, 05:42 | $0.0300 | 56% below the pre-attack close |
The sell-off began in the 10:00 UTC hour on Saturday, the hour the bridged tokens reached BNB Chain. Binance traded 105.9 million KAVA in that hour, against less than 3.4 million in each of the ten hours before; Coinbase traded 5.85 million, against less than 100,000 in a typical hour. Headlines picked different moments: The Block’s “nearly 40%” matched a price near $0.042 at publication, and The Defiant’s headline said 47%.
Since then the two books have not met. Binance kept falling into Saturday night while Coinbase held between about $0.039 and $0.052 from 13:00 UTC, leaving it about 40% above Binance on Sunday morning. Kava has not said which exchanges paused transfers, so it is not clear whether the suspensions explain why traders have not closed it.
On DefiLlama, Kava Lend’s total staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked fell from about $7.31 million on the 14 November daily point to $4.99 million at 04:12 UTC on Sunday. It had sat between $7.4 million and $7.5 million since 9 November. The backdrop was already weak: total crypto market value was down 5.77% over 24 hours at 05:39 UTC, with the Fear and Greed index at 10, after bitcoin’s weekend slide below $67,000.
Empty and dormant lending markets have failed this way before
Kava Lend began life as Hard Protocol, the money market of Kava’s chain, and its governance token still trades as HARD. Its weak point here was not new code but old code nobody watched: a BUSD market left open years after the stablecoin stopped being issued.
Markets with almost no money in them are a known trap for lenders. DefiLlama’s database lists Hundred Finance on Optimism, drained of $7.4 million on 15 April 2023 through rounding errors in an empty WBTC pool; Onyx Protocol, which lost $2.1 million on 1 November 2023 in a new PEPE market; and Radiant on Arbitrum, which lost about $4.5 million on 2 January 2024 through rounding on a newly opened USDC market. At Hundred and Onyx, the attacker inflated a market’s exchange rate with a donation; at Radiant, rounding in the burn function did the damage seconds after the market opened. The Kava case went through the interest index instead, but the root is the same: arithmetic that behaves at normal sizes and breaks near zero.
The year has been hard on lenders. As of 2 November, at least 33 lending and CDP protocols had been hacked in 2026 for a combined $192 million, with a median loss of $756,000, according to Immunefi, which names oracle manipulation as the leading cause, in 14 of the 33. The Block compares Kava with Hedera’s Bonzo Lend, which lost about $9 million in July, and with Tectonic on Cronos in August, which it puts at about $75 million; DefiLlama records Tectonic at $124.47 million. Our guide to how DeFi hacks and exploits work covers the main families, and our explainer on crypto lending and borrowing shows where collateral and borrowing caps fit.
What comes next: Kava’s incident report and the frozen transfers
The next document to watch is the incident report Kava has promised. It should say whether the BUSD market will be closed for good, how the borrowing cap was bypassed, and what happens to the users whose KAVA sat in the lending module. The report will also have to settle the gap between the 53.9 million and 55.2 million KAVA figures.
Two other points will decide how much is recovered: the fate of the roughly 612,416 USDT stopped at Relay, and the 4.58 million KAVA still parked at five addresses on Kava. Exchanges that paused KAVA deposits and withdrawals have not given a restart date. Anyone holding tokens in a small lending market can run through our 15-point DeFi due diligence grid, which asks, among other things, which markets a protocol still lists and who watches them.