Kava Lend (November 2026) hack — November 2026

Between 04:04 and 05:42 UTC on 14 November 2026 two wallets drained Kava Lend, the lending app on the Kava blockchain. According to Bitquery's block-by-block reading of the chain, they used the app's almost unused BUSD market: after reducing the pool's supply figure to two base units, its supply interest index grew about 243,000 times in three minutes, which inflated the value of their BUSD deposits as collateral. Against it they borrowed 55.2 million KAVA in 127 loans, and a liquidation erased the debt after each one. The KAVA held in the lending pool fell from 55.3 million to 519.

About 1.3 million of the borrowed KAVA went to repay other borrowers' loans, leaving the attackers with 53.9 million KAVA, about $3.67 million at the pre-sale price of $0.068 (the figure here). Six hours later a third wallet bridged most of it to BNB Chain and sold 48.4 million KAVA in 35 minutes for about $2.09 million, the low end; the price fell 36% during the sale and roughly half over two hours. Upbit, Bithumb and Coinone suspended KAVA deposits and withdrawals and a bridge was paused.

Kava said the event was isolated to Kava Lend and was not an infinite mint, and promised more information. About $1.17 million of the proceeds bought XMR1 on Hyperliquid. A further 612,416 USDT sent through LI.FI to the Relay bridge was not paid out (status BLOCKED_WALLET); Bitquery notes the deposit is marked as one the sender can pull back, so it is not counted as recovered. Kava has not said how lenders, who are owed the drained KAVA, will be covered.