Kava Lend exploit: attacker drains 55 million KAVA from the lending pool

An attacker almost completely drained the Kava Lend lending pool overnight into November 14, 2026. According to an on-chain analysis by The Block, the attacker borrowed about 55.2 million KAVA, worth roughly $3.8 million at the price before the attack. It was made possible by a barely used market for the stablecoin BUSD, where a calculation error inflated deposits by a factor of around 243,000. The KAVA token lost more than 40 percent within a day, and three Korean exchanges suspended deposits and withdrawals.

If you hold KAVA or have funds in Kava Lend, two things matter most right now. According to the project, no new tokens were created, but the pool's depositors are facing a shortfall. An official loss report was still missing as of Sunday afternoon.

Kava Lend exploit: what happened overnight into November 14

Kava is a layer-1 blockchain that combines technology from the Ethereum and Cosmos ecosystems. The KAVA token is used for staking, pays transaction fees and carries voting rights in the governance of the network. Kava Lend is the chain's in-house lending protocol. A lending protocol is an application where users deposit coins and earn interest on them, while other users borrow coins against collateral.

That protocol is what the attack hit. According to The Block's analysis, the attacker borrowed about 55.2 million KAVA from the pool after artificially inflating their own deposits. The data provider Bitquery reached the same gross figure in its own analysis, as reported by Cryptonews. After repaying other loans, the two wallets involved kept 53.9 million KAVA, worth about $3.7 million at the price before the sell-off. The range of $3.7 million to $3.8 million therefore describes the value of the borrowed tokens before the crash, not the attacker's proceeds.

Kava confirmed the incident on X. A post from the @KAVA_CHAIN account reads: “This is not an infinite mint. The event is isolated and contained within Kava Lend.” The team said it would publish a full incident report once it is complete.

The BUSD market as the entry point: how the interest bug inflated deposits

BUSD is a stablecoin pegged to the US dollar that its issuer Paxos has not minted since 2023. The BUSD market in Kava Lend was accordingly almost empty. That was the problem.

Kava Lend distributes the interest paid by borrowers to depositors. To do so, the code divides newly accrued interest by the market's net supply, meaning cash plus outstanding loans minus reserves. According to The Block's analysis, the publicly visible code skips this division when the denominator is exactly zero. With a tiny positive value, however, it keeps calculating. The attacker used a small loan to push the net supply of the BUSD market just above zero. As a result, every BUSD deposit was suddenly treated as worth about 243,000 times its value.

With this inflated collateral, the attacker borrowed KAVA again and again. Bitquery describes a second part of the attack: a helper wallet took out KAVA, and its loans were then liquidated even though there was hardly any BUSD left to cover them. That freed up room under the cap for KAVA loans again, and the sequence could be repeated 127 times.

Specialists call this an exploit: an attacker takes advantage of a weakness in the code without stealing passwords or breaking into servers. Formally, every single transaction follows the rules of the smart contract, but taken together those rules produce an outcome nobody intended.

LayerZero bridge to BNB Chain: where the borrowed KAVA went

After the attack, the attacker moved most of the loot to another blockchain. According to The Block, about 49.2 million KAVA went across the LayerZero bridge to BNB Chain. A bridge is a service that transfers tokens from one blockchain to another. There, the attacker sold most of it for about $2.1 million. Those sales put further pressure on the price.

Kava then paused withdrawals over the Axelar bridge as a precaution. That is a different bridge from the one the loot actually left through. For users this means that anyone who wants to move KAVA or other tokens off Kava via Axelar has to wait until the team reopens the bridge.

KAVA price after the exploit: down 48 percent in seven days

The price reacted sharply. According to CoinGecko data cited by Cryptonews, KAVA fell from about $0.068 to $0.0362 on November 14, a drop of 46.6 percent in 24 hours. On the afternoon of Sunday, November 15, KAVA traded at $0.0353 according to CoinPaprika. Over seven days the loss is therefore about 48 percent, while the price barely moved over the past 24 hours. Market capitalisation is now only about $38 million, putting KAVA in 385th place among the largest cryptocurrencies.

The crash comes in a week that was already weak. Bitcoin and Ether have fallen sharply for days, and we have put together a separate overview of this week's crypto crash. Most of KAVA's loss, however, is clearly down to the exploit and the sell-off on BNB Chain.

Upbit, Bithumb and Coinone: exchanges halt KAVA transfers

Three major exchanges in South Korea reacted on November 14. Upbit suspended KAVA deposits and withdrawals, flagged the token with a warning over elevated volatility and placed it on its watch list for a possible delisting. Bithumb and Coinone also halted transfers. According to Cryptonews, Bithumb kept trading open during the suspension, and Coinone said other services were not affected. On the same weekend, Coinone was also dealing with its own data breach at a support provider.

A transfer suspension protects customers from depositing tokens whose situation is still unclear. But it also means that anyone holding KAVA on one of these exchanges cannot withdraw it for now and can at most sell it there.

How to protect yourself from exploits on DeFi lending protocols

What happened: Overnight into November 14, 2026, an attacker used a calculation error in Kava Lend's almost empty BUSD market to borrow about 55.2 million KAVA, roughly $3.8 million at the pre-attack price according to The Block. After moving about 49.2 million KAVA across the LayerZero bridge, the attacker sold it on BNB Chain for about $2.1 million (as of November 15).

Are you affected? Those mainly affected are depositors who lent KAVA in Kava Lend. According to Bitquery, the pool owed depositors about 55.2 million KAVA on November 14 but held only 0.19 KAVA. If you hold KAVA only in your own wallet or on an exchange, you have not lost tokens in the attack, although you have taken the price loss. Kava has not yet said whether or how depositors will be compensated.

1. No new BUSD deposits: Bitquery warns that the attacker's inflated BUSD claim still exists and that new BUSD deposits in Kava Lend could be drained by them. Do not deposit anything there until the incident report is out.
2. Official channels only: Expect fake “refund portals” and direct messages in Kava's name. Read information on compensation only on the project's official website and its verified X account.
3. Revoke approvals: If you have used the same EVM wallet on BNB Chain or with other lending services, check open token approvals with an approval checker such as Revoke.cash and revoke anything you no longer need.
4. No transfers into the unknown: Do not send KAVA to Upbit, Bithumb or Coinone while their transfer suspension is in place, and not via the Axelar bridge until Kava reopens it.
5. Separate wallets: Set up a dedicated wallet with a small amount for DeFi lending and keep the larger part of your coins on a hardware wallet that is never connected to lending contracts.

Our guide on how to store crypto safely explains the basics of secure custody, and our hardware wallet comparison sets the right devices side by side.

KAVA in Germany: few trading venues since the Bitvavo delisting

For investors in Germany, KAVA has been harder to trade for several weeks already. Bitvavo, one of the large European exchanges with a MiCA licence, removed KAVA from its offering on September 18, as we reported on September 16, 2026; the details are in our piece on the Bitvavo delisting of Kava, Nano and Ravencoin. Anyone who wants to buy or sell KAVA today therefore often ends up on exchanges outside EU supervision.

After an incident like this one in particular, the licence is worth a look. An exchange with a MiCA licence must hold customer funds separately and is supervised by an EU authority, which in Germany is BaFin. Our comparison of regulated crypto exchanges shows which providers hold this licence. An exchange licence offers no protection against bugs in a lending protocol, though: Kava Lend is a decentralised service, and there is no deposit insurance there as there would be at a bank.

DeFi lending risk: why almost empty markets are dangerous

The Kava Lend case follows a pattern that keeps appearing in decentralised lending protocols. A market that hardly anyone uses any more remains technically open. Because there is little money in it, even small amounts are enough to shift metrics such as net supply. If the code does not calculate cleanly at such a point, a fringe market becomes a lever on the entire pool.

For depositors this means the risk lies not only in the coin you lend out but in the whole protocol with all its markets. According to Bitquery, a single bug in the BUSD market was enough to drain other users' KAVA deposits. With centralised providers the risk sits elsewhere, for example in custody by the company. Our crypto lending comparison shows which lending offers exist and how they handle interest and collateral.

Three questions help with any lending protocol. How many markets are there, and are dead markets closed? Are there recent security reviews of the code, known as audits? And is there a reserve fund that covers depositors' losses? If one answer is missing, a smaller amount is the more cautious choice.

Kava incident report: the questions still open

As of Sunday afternoon, Kava had published neither an official loss figure nor a root-cause analysis. Above all, it is unclear whether Kava Lend depositors will be compensated and from which funds. It is also unclear when the Axelar bridge will reopen and whether the faulty BUSD market will be closed or the code changed.

For the Korean exchanges, resuming transfers depends on exactly this report. Upbit has also put KAVA on its watch list; a delisting there would cost one of the most important remaining trading venues. If you hold KAVA, wait for the report before reshuffling positions, and do not let price swings in either direction push you into a decision.

Kava Lend exploit: without an incident report, the damage remains unclear

At about $3.8 million, the attack on Kava Lend is not a major hack, but it is a heavy blow for the pool's depositors. Until Kava presents the announced report, three steps make sense:

1. Check where your coins are held and separate lending balances from your long-term holdings. A hardware wallet from our hardware wallet comparison suits the long-term holdings.
2. If you want to keep earning interest on crypto, compare providers, collateral and liability before you deposit. The crypto lending comparison can help.
3. Trade KAVA and other coins through an exchange with an EU licence wherever possible. The overview of regulated crypto exchanges shows which providers are MiCA-licensed.

(As of November 15, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)