exploit
Kava Lend drained of 55M KAVA (~$3.8M) via BUSD collateral-inflation exploit
An attacker inflated deposit value in a dormant BUSD market, borrowed KAVA 127 times to bypass caps, and bridged 49.2M KAVA through LayerZero to BNB Chain. KAVA fell 40–47% in 24h.
An attacker drained roughly 55.2 million KAVA — about $3.76 million at the pre-attack price of $0.068 — from Kava Lend on November 14 by inflating the value of a dormant BUSD market, then borrowing against the inflated balance. Most of the proceeds, ~49.2M KAVA, were bridged via LayerZero to BNB Chain and partially sold into BNB and USDT. KAVA fell roughly 40–47% in the 24 hours that followed.
What happened
Kava Lend hosts a long-tail collection of lending markets alongside its main pairs. The BUSD market, unused since BUSD's wind-down, had net supply near zero. The attacker exploited that state: with the denominator of the interest-rate index close to zero, depositing a small balance made Kava Lend's book price the attacker's share at roughly 243,000× its underlying value. From that inflated collateral position, the attacker borrowed KAVA across 127 transactions on a second account, using many small borrows to stay under the protocol's per-call borrow cap.
The Kava module account that custodies deposited KAVA on Kava Lend fell from 55.33M KAVA to 0.19 KAVA. Roughly 4.58M KAVA remained on Kava across five unlabelled addresses. The remaining ~49.2M KAVA moved to BNB Chain via LayerZero and was partly sold into BNB and USDT; The Block puts the sold portion's value at about $2.09M.
Mechanism
Collateral-inflation via a dormant market is a recurring DeFi primitive: when a lending market's supply goes to zero, exchange-rate math that assumes a non-zero denominator becomes unstable. The attacker only needs to seed a tiny amount into the empty market to make the index collapse, after which deposits are priced at absurd multiples. Borrow caps on the target asset slow the exit but do not prevent it — the attacker split borrowing across many small calls under the cap.
Kava Labs said in response that the event is "not an infinite mint" and is "isolated and contained within Kava Lend." The team paused the Axelar bridge as a precaution and said partner exchanges paused KAVA deposits and withdrawals; no exchanges were named in the initial statement. Testing of the exploit pattern on-chain reportedly began around November 8, according to The Block.
Numbers
- Drain from Kava Lend module account: 55.33M KAVA → 0.19 KAVA
- Attacker KAVA on destination side: 55.2M KAVA (~$3.76M at $0.068 pre-attack)
- Bridged to BNB Chain via LayerZero: ~49.2M KAVA
- Sold on BNB Chain: ~$2.09M worth into BNB + USDT
- KAVA remaining on Kava across five addresses: ~4.58M
- Attacker borrow transactions: 127, splitting draws to bypass per-call cap
- BUSD-market deposit inflation factor: ~243,000×
- KAVA 24h price change: down ~40% (The Block) to ~47% (The Defiant)
What to watch
- Whether Kava publishes a formal post-mortem naming the exploiter EOA on Kava and the destination address on BNB Chain beyond
0x37D732914F86Cc6eb1E87419e3046A739F011042, and what the protocol proposes for reimbursement. - Whether Binance freezes the BNB Chain receiving addresses — LayerZero traffic from Kava Lend is now flagged, and the receiving address has activity on a CEX-adjacent hot path.
- Kava's Axelar bridge: Kava paused it preemptively. A restart requires confirmation the drain primitive cannot be re-run through another dormant market.
- Whether other lending protocols with legacy BUSD or long-tail dormant markets (Compound-fork descendants) audit their own zero-supply states. The exploit primitive is portable.
Context
This is the second Cosmos-ecosystem lending incident this quarter, following a broader pattern of exploits targeting Compound-style forks where market-listing governance lets a market go to a dormant state without removing it. Protocols that list many long-tail assets accumulate zero-supply attack surface over time; the fix is to disable interest accrual and borrows on markets below a floor, not simply to raise borrow caps.
LayerZero's role here is as a conduit, not a target — the bridge functioned as designed. The relevant question for Kava users is why the Kava Lend module permitted token draws at that scale within one block window without an admin rate-limit. BUSD's effective retirement in 2023 means every Compound-fork lending protocol that still lists it now carries the same shape of risk.