A Missing Zero Check Cost Kava Lend $3.8 Million in One Night

TLDR

An attacker took about 55.2 million KAVA from Kava Lend late Friday, worth about $3.76 million before the hack. The attacker used a dormant BUSD market and a missing check for tiny balances to inflate collateral about 243,000-fold. About 49.2 million KAVA was bridged to BNB Chain and sold for roughly $2.09 million. KAVA fell about 40% in a day, and Upbit, Bithumb and Coinone paused deposits and withdrawals. Kava says the event was not an infinite mint and is contained to Kava Lend.

---

An attacker took about 55.2 million KAVA from Kava Lend late Friday, according to onchain data reviewed by The Block. The tokens were worth about $3.76 million at the pre-attack price of $0.068.

Update on the situation:

We are aware of recent on-chain activity involving the bridging and sale of KAVA tokens on BSC.

To clarify: This is not an infinite mint. The event is isolated and contained within Kava Lend.

Partner exchanges have paused deposits/withdrawals as a…

— Kava (@KAVA_CHAIN) November 14, 2026

Kava Lend is the native lending protocol of the Kava blockchain. Its pooled deposits fell from 55.33 million KAVA to almost zero in about an hour and a half.

Kava is a Layer 1 blockchain that links the Ethereum and Cosmos ecosystems. Its KAVA token is used for staking, transaction fees and governance.

How the attack worked

The attacker used Kava Lend’s market for BUSD, a stablecoin that Paxos stopped minting in 2023. That market was almost empty before the attack.

Kava Lend works out depositor earnings by dividing borrower interest by a market’s net supply. The code skips that step when supply is exactly zero, but it does not check for tiny amounts above zero.

At 11:01 p.m. ET on Friday, the attacker used a small BUSD loan to cut the market’s net supply to two hundred-millionths of a dollar. Within three minutes, the value of every BUSD deposit grew about 243,000-fold.

The attacker’s earlier deposit was then counted as roughly 1.25 billion BUSD in collateral. The attacker borrowed KAVA against it 127 times.

A second account cleared each loan to get around the cap on KAVA borrowing. Records show repeated deposit and borrow cycles in the BUSD market starting Nov. 8.

Sales and market reaction

Starting at 4:59 a.m. ET on Saturday, the attacker bridged about 49.2 million KAVA to BNB Chain through LayerZero. Most of it was sold within the hour for 3,006.5 BNB and 231,557 USDT, worth about $2.09 million.

The BNB has since been moved out. Another 4.58 million KAVA went to five unlabeled addresses on Kava.

KAVA fell more than 40% during the day on Nov. 14. CoinGecko data shows the price dropping from about $0.068 to $0.041.

KAVA Price

Upbit, Bithumb and Coinone suspended KAVA deposits and withdrawals. Upbit also issued a caution notice and placed the token on its delisting watchlist.

Kava first acknowledged the incident on X at 6:28 a.m. ET on Saturday, more than seven hours after it began. It said it was tracking unexpected behavior from a dApp in its ecosystem.

About half an hour later, the team said the event was not an infinite mint. It said the incident was isolated and contained within Kava Lend.

Kava paused its Axelar bridge as a precaution, though the stolen tokens left through LayerZero. The team has not given an official loss figure or published a post-mortem.

The team said it will share a full incident report when it is ready. KAVA traded near $0.042 at publication, down about 39% over 24 hours.

The post A Missing Zero Check Cost Kava Lend $3.8 Million in One Night appeared first on CoinCentral.