An exploit at Kava Lend has drained roughly 55 million KAVA tokens from the lending protocol, highlighting a class of vulnerability that emerges when unusual market conditions expose dormant DeFi risks. The incident occurred on November 14 and did not involve token creation, but rather an accounting error that overstated collateral value.
The attack centered on Kava Lend's BUSD market, a stablecoin whose issuer ceased minting new tokens in 2023. The market was largely inactive, and by pushing its effective net supply extremely close to zero, the attacker triggered a calculation that exaggerated the accounting value of deposits by approximately 243,000 times.
This software-accounting error is particularly dangerous in lending protocols because borrowing limits depend on accurate collateral valuations. When that relationship breaks, the system can approve loans that no legitimate market price would support.
The attacker executed 127 KAVA borrow transactions, drawing roughly 55.2 million tokens from the pool. At the pre-attack price, those tokens were valued at approximately $3.76 million. Around 49.2 million KAVA were then sent to BNB Chain through LayerZero, with sales producing about $2.09 million in BNB and USDT according to on-chain analysis.
Kava's team confirmed the event was isolated to Kava Lend and did not involve an infinite-mint vulnerability. The protocol reported precautionary steps affecting bridging, while some trading venues restricted KAVA transfers. However, a full official post-mortem and recovery plan had not been published at the time of reporting.
The incident underscores how the most damaging DeFi exploits may originate from forgotten or inactive markets rather than heavily traded ones. For depositors in lending protocols, exposure to every supported collateral market carries risk, even for assets they do not directly use.
