Kava Lend hack drained 55.2 million KAVA through collateral valuation flaw

A hack at DeFi lending protocol Kava Lend over the weekend drained about 55.2 million KAVA tokens, NewsBTC reported. The attack was traced to an accounting calculation flaw that abnormally inflated collateral values by exploiting balances in the thinly traded BUSD lending market. BUSD, a stablecoin whose issuer halted new issuance in 2023, had seen little trading activity in that market. The attacker was said to have inflated the accounting value of deposits to around 243,000 times their actual value by pushing valid net supply extremely low. The attacker then carried out 127 KAVA borrowing transactions and withdrew about 55.2 million tokens from the lending pool. Based on KAVA’s pre-attack price, the haul was worth about $3.76 million. The attacker later moved about 49.2 million KAVA to BNB Chain through LayerZero and appears to have secured about $2.09 million worth of BNB and USDT during large-scale sales. As of now, no detailed incident investigation report or recovery plan has been disclosed.