Kava Lend Attacker Used 127 Loans to Bypass Borrowing Limit

An attacker borrowed about 55.2 million Kava (KAVA) from Kava Lend through 127 loans, using a second account to liquidate each one and get around the protocol’s borrowing limit.

The attacker first cut the net supply in a nearly idle BUSD market to a very small level. Within roughly three minutes, the market’s deposit value had risen about 243,000 times, inflating the collateral used to borrow KAVA.

The attacker repeated the borrowing process, while the second account liquidated each loan. That allowed the borrowing to continue beyond Kava Lend’s limit. Kava Lend is a lending protocol on the Kava blockchain.

The attacker repeatedly tested the market beginning Nov. 8. The 127-loan sequence adds detail to the Kava Lend exploit previously covered by TokenPost.