CandyPulse

Kava Lend Hit by $3.8 Million Exploit as KAVA Token Falls Nearly 40%

By · 2026-11-15 · News

Nov. 15 (CandyPulse) — In a week of falling prices, one project had a different kind of bad day. Kava Lend, a lending app on the Kava blockchain, was exploited for about $3.8 million, and the KAVA token dropped nearly 40%.

Key takeaways

What we know

ItemDetail
What was hitKava Lend, a lending app on Kava
WhenLate Friday, Nov. 13, into Nov. 14
Amount takenAbout 55.2 million KAVA (roughly $3.76 million before the attack)
HowThrough a thinly used BUSD market
KAVA priceAbout −40% ($0.068 to $0.041)
Exchange responseUpbit, Bithumb, Coinone paused KAVA deposits and withdrawals
Kava's responseAxelar bridge paused; full incident report promised

Loss estimates vary. Some reports cite about 48.4 million KAVA, worth roughly $3.3 million, moved to another blockchain. The Block reported the stolen KAVA was sold for about $2.1 million.

What happened, in plain English

A lending app lets people deposit one asset and borrow another, as long as their deposit is worth enough to cover the loan.

According to analytics firm Bitquery, the attacker used a helper wallet to borrow KAVA through a market for BUSD that hardly anyone used. The loans were then closed out by the app's liquidation process even though almost no BUSD was left to cover them. The attacker walked away with the borrowed KAVA.

In short: a neglected corner of the app had a weakness, and someone found it.

Why the price fell so hard

The attacker took KAVA, moved it to another blockchain and sold it. A large amount of a small token hitting the market at once pushes the price down quickly, and nervous holders sold too.

Kava's statement that this was "not an infinite mint" matters. It means the attacker took existing tokens from the lending app; they did not create new ones out of thin air. That limits the damage to what was drained.

What Kava has done

The lesson for everyone

DeFi apps are only as strong as their weakest market. Here it was a quiet, low-activity pool that few people were watching.

If you use lending or yield apps:

It's also why a design's safety details matter more than its promises; see our look at the proposed KSD stablecoin on Kaspa. Our crypto glossary explains "DeFi", "bridge" and "liquidation".

The timing

The exploit landed during a market-wide sell-off: Bitcoin broke below $64,000 and ether fell below $1,850 the same weekend. Bad news hits harder when confidence is already low.

What's next

Watch for Kava's incident report, whether affected users will be compensated, and when the exchanges and the bridge reopen.

More from today:

Track the market on our Bitcoin price today and crypto prices today pages, follow the Crypto News Today desk, and catch up every Sunday with CANDY Weekly.

Disclaimer: This article is for information only and is not financial advice. Market figures move quickly and different data providers can show slightly different numbers. Always do your own research before making any investment decision.

More on CandyPulse

CANDY Weekly: The Week in Crypto and the CANDY Ecosystem (Nov 9–15, 2026)

Global Equity Fund Inflows Hit a Seven-Week High as European Demand Leads

Prediction Markets in a Regulatory Clash as the CFTC Sues Louisiana Over Event Contracts

MSCI to Remove Strategy and Metaplanet From Its Indexes at the Nov. 30 Close

Trending now

One CANDY, More Ways to Use Crypto: Pay, Play and Create Across the CANDY Ecosystem

A Dollar Built on Kaspa? The KSD Whitepaper Outlines a New Path for Native DeFi

Swipe. Earn CANDY: How Cardaxo Turns Everyday Spending Into Crypto Rewards

Create Tokens Without Code: What CandyChain Studio Could Mean for Creators, Games and Communities

From Playing Games to Everyday Spending: How CandyRush Rewards Connect to Cardaxo

The Future Doesn't Build Itself: How CANDY Builds, Releases, Improves and Repeats