On this page
Key takeaways
- Kava says unexpected activity in Kava Lend, the lending app on its own blockchain, was isolated to that app and was not an infinite mint, meaning no new KAVA was created.
- On-chain analyses by The Block and Bitquery say about 55.2 million KAVA was borrowed out of the pool and never repaid, roughly $3.76 million at the pre-attack price, according to The Block.
- Most of the coins were bridged to BNB Chain and sold for about $2.1 million. Kava has not given an official loss figure or a root cause and says a full incident report is coming.
- Kava says exchanges it works with halted deposits and withdrawals as a precaution, and it paused the Axelar bridge. KAVA trades on Coinbase and Kraken in the US.
An attacker emptied the KAVA pool in Kava Lend, the lending app built into the Kava blockchain, late Friday, November 13, and sold most of the coins on another network early Saturday. Kava says the problem was limited to Kava Lend and that no new KAVA was created. It has not yet put a number on the loss or explained the root cause.
What Kava has confirmed
Kava's first public post came Saturday morning, when the team said on X (opens in a new tab) it was tracking unexpected behavior from an app in its ecosystem. About half an hour later it added (opens in a new tab): "To clarify: This is not an infinite mint." The team said the event was isolated and contained within Kava Lend, and that exchanges it works with had halted deposits and withdrawals as a precaution.
A third post said Kava had paused the Axelar bridge, which stops cross-chain withdrawals through that route for now, and that a complete incident report would follow. As of this writing, that report has not been published.
What the on-chain data shows
Two separate on-chain reviews, one by The Block (opens in a new tab) and one by the blockchain data firm Bitquery (opens in a new tab), describe the same pattern. These are their findings, not figures Kava has confirmed.
- How: both say the attacker used Kava Lend's nearly empty BUSD market. By shrinking that market's supply figure to almost zero, the attacker made the app value BUSD deposits roughly 243,000 times higher than they were, then borrowed KAVA against that inflated collateral in 127 loans.
- How much: about 55.2 million KAVA left the pool. The Block puts that at roughly $3.76 million at the $0.068 price before the attack. Bitquery says the pool went from about 55.3 million KAVA to 519.
- Where it went: most of the coins were bridged to BNB Chain and sold for about $2.1 million in BNB and USDT, per both reviews. Bitquery reports that the Relay bridge blocked 612,416 USDT of the proceeds.
Bitquery points out that the coins taken were deposits from people who had lent KAVA to the pool. Kava has not said whether those lenders will be repaid.
Price and exchanges
KAVA was at about $0.036 in a CoinGecko (opens in a new tab) pull at 6:22 p.m. ET on November 14, down about 46% over 24 hours. KAVA has active US-dollar markets on Coinbase and Kraken. We have not seen any statement from those two exchanges about the incident; Kava's post about paused deposits did not name the exchanges involved; Bitquery cites Crypto Briefing's report that South Korean exchanges Upbit, Bithumb and Coinone halted transfers.
What this means for you
The Block and Bitquery trace the loss to a flaw in one lending app's math, and Kava says the event was contained within Kava Lend rather than being an infinite mint. Kava has not yet confirmed the root cause. That distinction matters, but it is little comfort to anyone whose coins were in the pool. Our lending and borrowing guide explains why lenders in a DeFi pool carry this kind of smart-contract risk, with no insurance behind it.
- If you hold KAVA on a US exchange: nothing reviewed here says exchange accounts were breached. The price drop is a market loss, not an account hack. If a deposit or withdrawal is delayed, check the exchange's own status page.
- If you lent on Kava Lend: keep records and follow only Kava's official channels for the incident report.
- Expect recovery scams. After a hack, fake "fund recovery" services and lookalike accounts appear quickly. Never share a recovery phrase or pay a fee to get coins back. Our recovery-scam guide covers the warning signs.
This report reflects public information checked on November 14, 2026, and will be updated when Kava publishes its incident report. It is education only and does not tell anyone to buy, sell or keep a token.
Frequently asked questions
Were new KAVA coins printed?
Kava says no: it called the event "not an infinite mint." Bitquery's block-by-block reading agrees that the coins came out of the existing lending pool rather than being newly created.
I hold KAVA on Coinbase or Kraken. Was my account hacked?
Nothing reviewed for this article says exchange accounts were breached. The coins were taken from the Kava Lend pool. The token's price fell sharply, which affects every holder, but that is different from an account compromise.
I lent KAVA on Kava Lend. Is it gone?
The Block reports the pool's holdings fell from about 55.33 million KAVA to 0.19 KAVA, so it is effectively empty. Kava has not said whether or how lenders will be made whole. Watch Kava's official channels for its incident report and ignore anyone offering to recover funds for a fee.
How much was lost?
Kava hasn't published a number. The Block values the drained KAVA at about $3.76 million at the pre-attack price; selling the coins on BNB Chain raised about $2.1 million, according to both The Block and Bitquery.
Sources
- Kava update: not an infinite mint, contained within Kava Lend (opens in a new tab) — Kava (X)
- Kava: Axelar bridge paused, incident report to follow (opens in a new tab) — Kava (X)
- Kava Lend loses roughly $3.8 million to hack (opens in a new tab) — The Block
- Kava hack on-chain investigation (opens in a new tab) — Bitquery
- KAVA price and exchange markets (opens in a new tab) — CoinGecko
Published November 14, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.