Kava Lend, the lending app built into the Kava blockchain, had almost all of its KAVA deposits borrowed out early on Saturday, hours before about 48.4 million KAVA was bridged to BNB Smart Chain, Kava chain data shows. Kava says the tokens were sold there. KAVA fell more than 40% to a record low, and South Korea’s largest exchange froze KAVA transfers before the project said anything in public.
Update: Kava said later on Saturday it had paused the Axelar bridge as a precaution, halting cross-chain withdrawals through it, and that a full incident report would follow.
Kava said the bridging and sale of KAVA on BSC “is not an infinite mint.” “The event is isolated and contained within Kava Lend,” the team said. Partner exchanges paused deposits and withdrawals “as a standard precautionary measure,” it added, promising more information. The team has not yet said what went wrong or who carries the loss.
What the chain data shows
Kava Lend’s own ledger still records about 55.2 million KAVA as supplied by depositors. The module account that is supposed to hold those tokens now has 0.19 KAVA. The same ledger shows only about 2,640 KAVA out on loan.
The tokens left in one burst. Between 04:04 and 05:42 UTC on Saturday, a single address borrowed 55.2 million KAVA from Lend across 127 transactions. In 122 of them the amount was about 445,720 KAVA, just under the 448,358 KAVA borrowing cap the protocol’s governance set in October.
Each of those transactions followed the same script. One address sent a block of BUSD, a dollar stablecoin that has not been newly issued since 2023, to the borrowing address, which deposited it into Lend, and the first address then withdrew the same amount from Lend. That loop ran six or seven times inside a single transaction before the KAVA borrow went through. Kava has not said whether that loop is how the limits were beaten.
The borrower then sent about 53.9 million KAVA to the second address, which moved 47.2 million KAVA to a third account at 10:01 UTC. That account sent 149,046 KAVA into a cross-chain bridge contract on Kava’s EVM side at 09:59 UTC and 48.21 million KAVA at 10:02 UTC, a combined 48.36 million. That is the amount on-chain watchers flagged arriving on BSC.
The selling showed up right away. KAVA traded near $0.068 until about 10:05 UTC and was down to roughly $0.047 half an hour later, according to CoinGecko data. It touched a record low of $0.0356 at 11:57 UTC and was near $0.041 at the time of writing, down about 40% over 24 hours.
The bridging did not stop with the statement. The same account sent another 849,081 KAVA into the bridge at 12:05 UTC, about four minutes after Kava said the event was contained. Total KAVA supply on the chain is unchanged at about 1.083 billion tokens, which fits Kava’s account that nothing was minted. The 55.2 million KAVA taken from Lend is about 5% of that supply.
Upbit moved before Kava spoke
Upbit suspended KAVA deposits and withdrawals at 10:36 UTC, citing signs of a security incident and invoking a user-protection provision of Korea’s virtual asset rules. At 11:00 UTC it added a trading caution notice, saying it had found circumstances suggesting a security problem on the Kava chain and warning of wider price swings.
Kava’s first public word came at 11:28 UTC, when it said it was tracking “unexpected behavior originating from a dApp within the Kava ecosystem.” The update naming Kava Lend followed at 12:01 UTC. Bithumb and Coinone also halted KAVA transfers, according to several reports.
Upbit’s caution label carries weight. On Friday the exchange said it would delist MANTRA on Dec. 14, after putting that token on caution in August over a hacking incident it judged unresolved. MANTRA, another Cosmos-based chain, had its own scare this week when it tripped a circuit breaker on unstaking after attackers went after staked tokens.
A protocol that was already closing
Kava Lend was being wound down when this happened. Proposal 222, which passed on Oct. 5, was billed as “Phase 2” of the wind-down of Kava Mint, Lend and Swap. It ended incentives, closed reward claims on Nov. 1, set Lend borrow limits near outstanding balances and told users to close positions before a third phase.
That left a thin, little-watched pool still holding tens of millions of KAVA in recorded deposits. One of the two addresses behind the BUSD loop began depositing and withdrawing BUSD in Lend on Nov. 8, six days before the drain.
What to watch
Three questions are open. The first is whether Kava explains the flaw and says how depositors whose KAVA sat in Lend will be treated. The second is how much of the bridged KAVA has been sold and how much still sits on BSC, since a remaining overhang would keep pressure on the price. The third is when Upbit, Bithumb and Coinone reopen transfers, and whether Upbit’s caution notice leads to a formal listing review.
FAQ
Was KAVA minted in the Kava Lend incident?
Kava says no, and the chain’s total KAVA supply is unchanged at about 1.083 billion. The tokens were borrowed out of Kava Lend’s existing deposits and then bridged to BNB Smart Chain.
How much KAVA left Kava Lend?
Chain data shows one address borrowed about 55.2 million KAVA in 127 transactions on Saturday, and 48.36 million KAVA was then sent through a bridge to BSC, with another 849,081 KAVA following later.
Can Upbit users deposit or withdraw KAVA?
Not for now. Upbit suspended KAVA deposits and withdrawals and said it will announce a restart once it has confirmed transfers are stable. Bithumb and Coinone also paused transfers.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
