SECURITY ALERT
The token had barely moved for a week.
Then it lost almost half its value in two hours.
Kava, the Cosmos-and-Ethereum chain, said on X at 12:01 UTC on Saturday that it was aware of on-chain activity involving “the bridging and sale of KAVA tokens on BSC”, the BNB Chain network, and that the event was “isolated and contained within Kava Lend”, its lending market. It said: “This is not an infinite mint.”
It has not said what went wrong, how much left, or who moved the tokens.
What Kava has said
At 11:28 UTC, Kava said it was tracking “unexpected behavior originating from a dApp” on its chain and investigating with high priority.
At 12:01 UTC came the update above. Partner exchanges had paused deposits and withdrawals “as a standard precautionary measure”, it said.
At 14:05 UTC, it said the Axelar bridge had been paused “out of an abundance of caution”.
Cross-chain withdrawals through Axelar are stopped for now. A full incident report will follow “as soon as it is ready”. No time was given.
Bithumb warned its users of a security incident at Kava and said KAVA deposits and withdrawals were suspended. TokenPost reported that Upbit and Coinone did the same.
Does “contained” mean the money stayed inside Kava Lend?
What the numbers show
On-chain reports cited by Crypto Briefing say about 48.3 million KAVA, worth roughly $3.2 million at the time, crossed to BNB Chain and was mostly sold for BNB. We have not verified that figure on chain, and Kava has not confirmed it.
CoinGecko hourly data show KAVA near $0.068 until about 09:50 UTC, near $0.050 by 10:50 UTC and near $0.037 by 11:50 UTC. The slide began in the 10:00 UTC hour, before Kava’s first post.
It traded near $0.0406 at 14:45 UTC, down about 41% in 24 hours, with a market value of about $43 million.
Kava Lend held about $5.6 million in deposits on DefiLlama’s latest reading, down from about $7.3 million the day before. A TVL drop mixes withdrawals with price falls. It is not a loss figure.
Who was selling in the 10:00 UTC hour, before the project said a word?
What we don’t know
Kava has not named the dApp’s flaw, the number of tokens involved, or whether Kava Lend depositors will be made whole.
An “isolated” event can still hurt the people inside it. Kava has not said how Kava Lend users are affected.
No attacker is named here, and we do not name one.
How does a lending market send tokens across a bridge?
Protect yourself
- Do not deposit to, borrow from or withdraw from Kava Lend until Kava’s incident report says it is safe.
- Do not bridge KAVA through Axelar or any other route while the pause stands. Check the exchange notice before sending KAVA to a Korean exchange.
- Treat “compensation” or “recovery” links as likely scams. Use only Kava’s official X account.
This week Korea said exchanges there may freeze withdrawals when a hack is only suspected: Korea will let exchanges freeze withdrawals on a suspected hack. Initia, another Cosmos chain, halted for the second time this month after a key compromise. For background, see what DeFi lending is.
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.