Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4PiqcD…kc3JSummary
Lava (lavadefi.io) is a decentralized, non-custodial multichain lending and borrowing protocol deployed on Arbitrum and Base, operating since March 2024. The protocol suffered two documented exploit incidents in 2024 totaling approximately $470,000 in losses, both rooted in protocol logic vulnerabilities and flash loan abuse. The platform was flagged by on-chain investigator ZachXBT, and separately the lava.xyz Bitcoin lending product drew significant backlash in late 2025 after quietly switching users from a self-custodial DLC-based model to a fully custodial setup without adequate disclosure.
Connected Entities
1 entitiesTimeline(9 events)
7 March 2024
Lava Finance (lavadefi.io) launches as a decentralized multichain lending and borrowing protocol on Arbitrum and Base.
28 March 2024
PeckShield Alert publicly reports an active exploit on Lava Finance. All lending markets are paused within 15 minutes.
29 March 2024
Lava Finance flash loan exploit confirmed. Approximately $340,000 lost via a protocol logic vulnerability in the liquidation engine. Law enforcement reports filed; attacker address flagged on Arbiscan.
26 April 2024
Lava Finance publishes a post-mortem on HackMD detailing the exploit, remediation steps including the _limitFees function fix, and Insurance Fund compensation for affected users.
4 October 2024
A second exploit targets Lava Finance on Arbitrum, resulting in approximately $130,000 in losses via a protocol logic flash loan attack, despite prior mitigations.
September 2025
Lava (lava.xyz) pushes an app update prompting users to migrate funds to new vaults, without disclosing the transition from self-custodial DLCs to a fully custodial cold-storage model.
4 November 2025
Owen Kemeys of Foundation Devices publicly questions Lava's consent practices on X, triggering widespread media coverage of the custody model shift.
14 November 2025
Gizmodo, Bitcoin Magazine, Blockspace, and Protos publish investigations into Lava's custody model pivot. Jack Mallers raises regulatory legality concerns. Lava CEO Shehzan Maredia defends the change citing DLC technology risks.
November 2025
Lava (lava.xyz) announces $200 million in new funding from Founders Fund, Khosla Ventures, Susquehanna, and angels including Anthony Pompliano, concurrent with the custody controversy.
Decision Log
- hash: H3cuxdEPgdTXV5FVdc5Doskm4HGJ5AF97zRsFJkfaCXX
This investigation is cryptographically anchored to the Solana blockchain (1 event). 12 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:33 AM
last updated: 8/30/2026, 5:14:08 AM
avoid.net — verified advice for a post-truth world