Blockchain analytics firm Bitquery traced the operation to two wallets that exploited Kava Lend’s BUSD market, inflating its supply interest index approximately 243,000-fold before extracting KAVA through 127 loans. Bitquery also identified 612,416 USDT in suspected proceeds blocked at the Relay bridge, although the funds have not been confirmed as recovered.
Kava acknowledged the incident on Saturday, saying it was confined to Kava Lend and did not involve the creation of new tokens. The team has not published a final loss estimate or comprehensive incident report.
How Did a Dormant BUSD Market Enable the Attack?
The exploit originated in Kava Lend’s market for Binance USD (BUSD), a stablecoin that Paxos stopped minting in February 2023. The market remained operational despite having almost no available liquidity.
According to Bitquery’s November 14 investigation, the attacker manipulated the market’s effective supply to just two base units, equivalent to approximately $0.00000002.
Kava Lend’s interest calculation divides interest accrued by the market’s effective supply. Its code contains protection against division by zero but does not adequately address extremely small positive denominators.
As a result, a small amount of accrued interest generated an extraordinary increase in the supply index. Within three minutes, the index rose from approximately 2.76 to 671,187, multiplying the recorded value of deposits by roughly 243,000.
The attacker’s BUSD collateral was consequently valued at approximately $1.26 billion, despite the absence of corresponding assets supporting that valuation.
A second wallet then used the inflated collateral to borrow KAVA repeatedly. The attacker manipulated liquidation and collateral-withdrawal processes so that loans could be closed without recovering sufficient assets, effectively circumventing the protocol’s borrowing limits.
Bitquery identified 127 borrowing transactions over approximately 98 minutes. Its reconstruction indicates that the wallets extracted 55.2 million KAVA in gross borrowing and retained approximately 53.9 million after transactions involving other borrowers.
Investor Takeaway
The exploit did not require manipulating KAVA’s external market price to obtain loans. A flaw in internal interest accounting created fictitious collateral value, demonstrating how dormant lending markets can expose assets deposited elsewhere in the same protocol.
Where Did the Stolen KAVA Go?
Approximately 49.2 million KAVA was transferred to BNB Chain through LayerZero, beginning early Saturday. Most of the bridged tokens were subsequently sold for approximately 3,006.5 BNB and 231,557 USDT, representing about $2.09 million in proceeds.
The distinction between the stolen tokens’ pre-attack valuation and actual sale proceeds is important. The $3.76 million estimate reflects KAVA’s approximately $0.068 price before the incident, not the amount realized by the attacker.
Bitquery’s investigation traced $1.17 million of the proceeds into approximately 2,190 XMR1 tokens on Hyperliquid across eight accounts. Its analysis also identified 612,416 USDT blocked by Relay, with the transaction carrying a BLOCKED_WALLET designation.
That amount represents approximately 29% of the $2.09 million in reported sale proceeds. The restriction prevented the identified transfer from completing, but it does not establish that the funds have been returned to Kava Lend or affected depositors.
Additional KAVA was transferred to other addresses on the Kava network. The identities of the people controlling those wallets remain unknown.
Investor Takeaway
The $612,416 blocked at Relay offers a potentially important recovery lead, but blocked funds should not be counted as recovered assets. The amount ultimately recoverable will depend on custody, control of the identified addresses and any subsequent enforcement or recovery action.
Why Did KAVA Fall as Exchanges Suspended Transfers?
KAVA fell sharply as the exploited tokens entered secondary markets. The token declined approximately 39% to $0.042 during the initial reporting period, with subsequent market data indicating deeper losses approaching 50%.
South Korean exchanges Upbit, Bithumb and Coinone suspended KAVA deposits and withdrawals while assessing the incident. Upbit also issued a trading caution notice.
Kava separately paused its Axelar bridge as a precaution, although the reported attacker transfers had used LayerZero rather than Axelar.
The distinction matters because the bridge restrictions were a response to the incident, not evidence that the Axelar bridge itself had been compromised.
Kava said the incident was isolated to its lending application. That statement does not establish the final scale of depositor losses or whether all affected users will be reimbursed.
How Does the Incident Compare With Other DeFi Lending Exploits?
The Kava incident follows several 2026 attacks involving artificially inflated collateral valuations, although the underlying technical failures have differed.
In August, Tectonic suffered an estimated $75 million exploit after an attacker manipulated the price of TONIC collateral. Cronos validators halted the blockchain in an effort to prevent additional asset transfers.
Earlier that month, Moonwell experienced an estimated $8.7 million exploit involving manipulated MAMO collateral on Base.
In July, Bonzo Lend reported approximately $9 million in losses after an external oracle verification failure allowed a manipulated collateral price.
Unlike those incidents, Kava Lend’s apparent failure centered on its internal interest index and liquidation accounting rather than an externally manipulated token price or oracle feed.
The immediate priorities are determining the protocol’s remaining liabilities, establishing whether the affected markets can operate safely and identifying what portion of the extracted assets can be recovered.
Investor Takeaway
For DeFi lenders, the incident demonstrates that borrowing limits and collateral ratios cannot prevent losses when the underlying accounting system produces false values. Kava’s eventual post-mortem and any depositor compensation plan will be more informative about the protocol’s financial condition than the initial token-price reaction.
