✓ Verified by 2+ outlets BNB
An attacker borrowed Kava Lend's KAVA pool dry using a dead BUSD market, then dumped the haul on BNB Chain as KAVA sank about 40%
Summary
An attacker drained about 55.2 million KAVA, worth roughly $3.76 million at pre-attack prices, from Kava Lend, the native lending protocol of the Kava blockchain, late Friday, according to onchain data reviewed by The Block.
The Block reports the attacker inflated the value of deposits in Kava Lend's nearly empty BUSD market about 243,000-fold, then borrowed KAVA against that collateral 127 times.
About 49.2 million KAVA was then bridged to BNB Chain and sold for roughly $2.1 million in BNB and USDT, The Block says; Crypto Briefing reports that the bridging and selling contributed to the token's sharp drop.
Kava said the incident was "isolated and contained within Kava Lend" and was "not an infinite mint," according to both outlets, and it has not yet put an official number on losses or published a post-mortem.
Both outlets put KAVA's fall at roughly 40% in 24 hours, from about $0.068 to near $0.041-$0.042.
Key facts
- Kava Lend's module account went from holding 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half.
- The exploited code skips a division when the market's supply figure is exactly zero but does not check for tiny figures above zero; the attacker pushed BUSD net supply down to two hundred-millionths of a dollar before the value multiplied.
- The attacker used a second account to clear each loan and get around Kava Lend's KAVA borrowing cap, and appears to have prepared since Nov. 8 with repeated deposit and borrow cycles in the BUSD market.
- Another roughly 4.58 million KAVA went to five unlabeled addresses on Kava.
- Kava's first public acknowledgment came more than seven hours after the attack started.
- Upbit suspended KAVA deposits and withdrawals, issued a caution notice and put the token on its delisting watchlist; Bithumb and Coinone also halted transfers.
- Kava paused its Axelar bridge as a precaution and said it would publish a full incident report when ready.