55.2 Million KAVA Drained From Kava Lend Protocol, Worth $3.76 Million
Key Facts
An attacker drained about 55.2 million KAVA tokens from the Kava Lend protocol on November 14, worth an estimated $3.76 million at pre-attack prices, according to The Block. An accounting flaw in the inactive BUSD market inflated deposit values by about 243,000 times, enabling the attacker to borrow KAVA against the inflated collateral through 127 transactions. The Kava team said the incident was confined to Kava Lend and did not represent an unlimited issuance of tokens. The funds were drained from the lending pool, which holds the protocol’s pooled deposits. The team had not announced an official loss figure or published its full report by the time The Block’s coverage appeared.
Kava Lend uses a decentralized money-market model that allows users to lend and borrow cross-chain assets, with deposited assets serving as collateral for other assets, according to Kava’s documentation. In the BUSD market, Bitquery’s analysis showed that the pool’s liabilities to depositors stood at 440,145 BUSD before the attack, while outstanding loans totaled 5,084 BUSD. The pool had no more than 0.003 BUSD in available cash, with 37 open loans. These figures show that the market had little cash liquidity before the exploit, despite outstanding liabilities and debt. Paxos announced on February 13, 2023, that it would end its relationship with Binance and stop issuing new BUSD tokens as of February 21, 2023; the company now says it does not issue new tokens and allows them to be redeemed or converted to USDP.
The Kava Lend pool account balance fell from 55.33 million KAVA before the drain to 0.19 KAVA a little more than an hour and a half later, according to The Block. Bitquery’s analysis gave a different reading of the final balance, estimating it at 519 KAVA; it also said successive loans were liquidated and their debt removed without sufficient collateral recovery. The analysis concluded that two wallets withdrew 55.2 million KAVA through 127 loans. The comparison between the two balances shows that most of the pool’s holdings were drained, while published readings of the remaining balance did not match. The Kava statement cited by The Block did not provide an official figure for lender compensation or details on fund recovery.
The attacker began transferring about 49.2 million KAVA to an address on BNB Chain via the LayerZero bridge at 4:59 a.m. Eastern Time on November 15, according to The Block. Bitquery’s analysis said the on-chain sell-off involved 48.4 million KAVA over 35 minutes, with the price falling 36% during that period. This percentage measures the price move on BNB Chain during the sale and does not represent KAVA’s overall price movement across all markets. The Block also reported that the drained tokens left the network via LayerZero. The transfer to another network thus separated the borrowing from the pool from the sell-off tracked by the on-chain analysis.
Bitquery’s analysis found that the Relay bridge blocked 612,416 USDT, equivalent to 29% of the sale proceeds it tracked, as of its reading on November 14. Kava said in a statement cited by The Block at 9:05 a.m. Eastern Time on November 15 that it had halted the Axelar bridge "out of an abundance of caution," although the drained tokens had left via LayerZero. The team stressed that the incident was "not an unlimited issuance of tokens" and was "confined and contained within Kava Lend." Partner exchanges suspended deposits and withdrawals, The Block reported; Bitquery’s analysis attributed the frozen transfers to three Korean exchanges. Kava pledged to publish a full report when it was ready, but publicly available sources did not include official details on losses or compensation at the time.