Attackers Borrow 55.2 Million KAVA in Kava Lend Exploit

Attackers borrowed about 55.2 million Kava (KAVA) from Kava Lend, then moved most of the tokens off the Kava blockchain and sold them, prompting exchange and bridge restrictions.

The borrowing exploited an inactive BUSD market on the lending protocol. The mechanism inflated deposit value by about 243,000 times, allowing attackers to use the overstated collateral to borrow KAVA repeatedly.

About 49.2 million of the borrowed KAVA was then sent to BNB Chain through LayerZero, a cross-chain service. Most of the tokens were sold there for roughly $2.09 million in BNB and USDT. Before the attack, the borrowed amount had a market value of about $3.76 million.

Partner exchanges halted KAVA deposits and withdrawals, and Kava's team paused the Axelar bridge. Those steps restricted KAVA transfers through exchange accounts and the Axelar route. Kava said the incident was confined to Kava Lend and did not involve unlimited token issuance. Kava Lend is a lending protocol on the Kava blockchain.