The BUSD market failure
I find the Kava Lend exploit to be a result of sloppy math in a dormant BUSD market. An attacker drained 55.2 million KAVA tokens from the protocol late Friday, which left the module account with only 0.19 KAVA after it previously held 55.33 million. This drain, valued at $3.76 million at the $0.068 pre-attack price, occurred after the attacker manipulated the BUSD market’s net supply. The exploit targeted BUSD, a Binance-branded stablecoin that issuer Paxos stopped minting in 2023. At 11:01 p.m. ET on Friday, the attacker used a small BUSD loan to bring the market’s net supply down to two hundred-millionths of a dollar, which caused the protocol to multiply the value of every BUSD deposit roughly 243,000-fold. Because Kava Lend’s code does not check for minute figures above zero, the protocol counted the attacker’s BUSD deposit as 1.25 billion BUSD in collateral. Kava acknowledged the unexpected behavior on X at 6:28 a.m. ET on Saturday. The attacker ran repeated deposit and borrow cycles in the BUSD market starting November 8.
| Exploit Variable | Value |
|---|---|
| KAVA tokens drained | 55.2 million |
| Pre-attack KAVA price | $0.068 |
| Post-attack KAVA price | $0.042 |
| Manipulated BUSD collateral | 1.25 billion BUSD |
| Attacker borrow attempts | 127 |
The attacker used these inflated BUSD deposits to borrow KAVA 127 times through two different accounts to circumvent borrowing caps. Onchain data shows the attacker prepared for a week. The protocol’s failure to verify supply levels makes this an easy target for anyone looking to exploit dormant markets.
Loot movement and market crash
The KAVA token price dropped 39% in 24 hours to roughly $0.042. After the theft, the attacker bridged 49.2 million KAVA to the BNB Chain through Kava’s LayerZero bridge starting at 4:59 a.m. ET on Saturday. Most of those tokens went for 3,006.5 BNB and 231,557 USDT, a combined value of about $2.09 million. Kava paused the Axelar bridge at 9:05 a.m. ET out of an abundance of caution, and partner exchanges paused deposits and withdrawals as a standard precautionary measure. I view this as another predictable failure in the lending sector, which saw a $75 million Tectonic exploit in August and a $9 million Bonzo Lend hit in July. The attacker used a second account to clear each loan and bypass KAVA borrowing caps. Another 4.58 million KAVA went to five unlabeled addresses on Kava, while most of the BNB from the sale moved out of the attacker’s address.
