On-chain review traces 55.2 million KAVA out of Kava Lend

An attributable on-chain investigation found that two wallets borrowed 55.2 million KAVA from Kava Lend on November 14 and retained the coins after a sequence of liquidations erased the associated debts. The finding matters because the reviewed pool was left with almost none of the KAVA owed to suppliers, while exchanges suspended transfers and the protocol operator had not published a technical postmortem by Coinburn’s publication time.

Bitquery’s review covers Kava transactions through approximately 16:20 UTC on November 14 and activity on BNB Chain and several destination networks through nearby snapshots. It is an external analysis of public-chain data, not a finding from Kava Labs, a regulator or a court.

What the transactions show

Bitquery counted 127 KAVA loans across a 98-minute window from 04:04 to 05:42 UTC. Its reconstruction says the wallets manipulated a nearly inactive BUSD market until that market’s supply index increased about 243,000-fold in three minutes. The resulting BUSD claim was then used as collateral for repeated KAVA borrowing.

According to the dataset, each loan was liquidated, but the liquidation process closed the debt without recovering the BUSD collateral or the borrowed KAVA. The KAVA pool’s reported cash balance fell from 55.3 million coins to 519. Bitquery attributed the activity to wallet behavior and transfers; it did not identify the people controlling the wallets.

The investigators traced 49.2 million KAVA to BNB Chain. Beginning shortly after 10:07 UTC, one wallet sold 48.4 million KAVA through 46 transfers over 35 minutes. Bitquery valued the proceeds at approximately $2.09 million using asset prices at the time each transfer occurred. That valuation is not the pre-sale value of the coins, and it can change under a different pricing or transaction-attribution method.

Bitquery also reported that Relay marked a transfer of 612,416 USDT as blocked. That status was observed at 16:20 UTC; the investigation did not establish that the funds were permanently seized, returned or otherwise unavailable after the snapshot.

Exchanges restrict transfers, not trading

Bithumb said it would suspend KAVA deposits and withdrawals from 19:35 Korea Standard Time, or 10:35 UTC, because of circumstances suggesting a security problem. Its notice explicitly said trading would remain available during the interruption.

Coinone announced the same operational restriction from 19:40 KST, five minutes later. It said deposits and withdrawals would resume only after security measures and network-stability checks, without setting a reopening time. Coinone subsequently warned customers about indications of a security incident but had not formally designated KAVA as a cautionary trading asset in the notice reviewed by Coinburn.

Those actions establish that two exchanges restricted token movement. They do not independently verify Bitquery’s explanation of the lending-pool failure or establish losses for either exchange.

What remains unresolved

Kava’s own documentation describes Kava Lend as a cross-chain money market where users supply assets, borrow against collateral and earn interest. The outstanding question is how the application will account for the reported 55.2 million-KAVA shortfall owed to suppliers.

Kava had not released a transaction-level incident report, remediation plan or compensation commitment by publication time. Bitquery cautioned that its interpretation relies on public node history, open code and proprietary address labels, which may be incomplete or revised. Its exchange-address labels also do not establish that any named venue knew the source of incoming assets.

Until Kava publishes a postmortem, the evidence supports describing a lending-pool failure reconstructed from on-chain activity—not a failure of Kava consensus, an unlimited mint or a final measure of recoverable losses.