Kava Lend Empty-Market Inflation

On November 13, 2026, Kava Lend, the money market native to the Kava blockchain, was drained of roughly 55.2 million KAVA — about $3.76 million at the pre-attack price — after an attacker inflated the share price of a nearly dormant BUSD market and borrowed against phantom collateral. The attack began around 11:01 p.m. ET and ran for roughly an hour and a half before Kava acknowledged it.

What happened

Kava Lend calculates depositor interest by dividing accrued borrower interest by a market's net supply. The code guarded against a net supply of exactly zero, but not a tiny positive value — a classic rounding-and-donation hazard also seen in ZeroLend's empty-market exploit.

The attacker targeted the market for BUSD, the Binance-branded stablecoin that Paxos stopped minting in 2023, leaving the market all but empty. Using a small BUSD loan, the attacker pushed net supply down to roughly two hundred-millionths of a dollar. Over about three minutes, the value credited to each BUSD deposit rose about 243,000-fold, so the attacker's pre-deposited BUSD was counted as roughly 1.25 billion BUSD in collateral.

Against that phantom balance the attacker borrowed KAVA 127 separate times, using a second account to liquidate each loan in turn and slip past Kava Lend's per-position KAVA borrowing cap. On-chain evidence suggests probing began around November 8. The Kava Lend module account fell from 55.33 million KAVA to 0.19 KAVA.

Aftermath

• About 49.2 million KAVA was bridged to BNB Chain via LayerZero and mostly sold for roughly 3,006.5 BNB and 231,557 USDT (~$2.09 million); another ~4.58 million KAVA was scattered to five Kava addresses.
• Kava paused its Axelar bridge as a precaution — though the stolen KAVA had already exited through LayerZero — and said partner exchanges suspended KAVA deposits and withdrawals.
• Kava stated the event was "not an infinite mint" and was contained within Kava Lend, promising a full incident report. No funds have been recovered, and the KAVA token fell roughly 40% within 24 hours.

Why it matters

Kava Lend is a textbook share-price inflation failure: a market everyone had forgotten about became the entry point because its near-zero supply broke the interest-accrual math. It echoes ZeroLend's empty-market donation attack and Cream Finance's collateral-inflation drain — different mechanics, same outcome, where fabricated collateral is converted into real borrowing. It also fits the recurring 2026 lesson that dormant or deprecated markets remain live attack surface, the same theme that surfaced in ACryptoS's vault bug: a listing nobody uses still needs a protective floor on supply, or its denominator becomes a weapon.