KAVA Lend loses $3.8 million in a crypto hack
An attacker drained digital money by inflating deposit values and borrowing against them. The KAVA token fell nearly 40% after the attack.
An attacker drained about 55.2 million KAVA tokens from KAVA Lend, the native lending protocol of Layer 1 blockchain Kava, late Friday. The attacker inflated the value of deposits in a dormant digital dollar market and borrowed against them, according to onchain data reviewed by The Block.
The tokens were worth roughly $3.76 million before the attack. KAVA Lend went from holding 55.33 million KAVA to 0.19 KAVA in a little over an hour and a half. KAVA wrote on X that it was tracking unexpected behavior originating from a decentralized app within its ecosystem.
The exploit ran through a market for BUSD, a digital dollar that issuer Paxos stopped minting in 2023. The attacker used a small loan to lower the market net supply and multiplied the value of every deposit. The attacker then borrowed KAVA against the deposit 127 times.
Beginning early Saturday, the attacker bridged about 49.2 million KAVA to an address on BNB Chain. Most of it was sold within the hour for about $2.09 million combined. KAVA traded down about 39% over 24 hours. Partner exchanges paused deposits and withdrawals, and KAVA paused its bridge out of caution.
Figures as reported by The Block.
