{"investigation":{"slug":"lava","entity_name":"Lava","trust_score":42,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Lava (lavadefi.io) is a decentralized, non-custodial multichain lending and borrowing protocol deployed on Arbitrum and Base, operating since March 2024. The protocol suffered two documented exploit incidents in 2024 totaling approximately $470,000 in losses, both rooted in protocol logic vulnerabilities and flash loan abuse. The platform was flagged by on-chain investigator ZachXBT, and separately the lava.xyz Bitcoin lending product drew significant backlash in late 2025 after quietly switching users from a self-custodial DLC-based model to a fully custodial setup without adequate disclosure.","sections":[{"content":"Lava Finance (lavadefi.io) launched on March 7, 2024 as a decentralized, non-custodial, multichain liquidity optimization platform. The protocol enables users to lend, borrow, and leverage liquidity positions derived from automated market maker (AMM) platforms including Uniswap, Curve, and GMX. It is deployed on the Arbitrum and Base blockchains, with stated plans for future multichain expansion. The protocol's native token is $LAVA, with a fixed total supply of 1,000,000,000 tokens. Lava Finance is distinct from, though easily confused with, two other entities that share the Lava name: Lava Network (lavanet.xyz), a decentralized RPC infrastructure provider, and Lava (lava.xyz), a Bitcoin-backed lending fintech that raised $200 million in November 2025. The DeFi protocol at lavadefi.io is the entity that suffered the documented exploits and was flagged by ZachXBT. According to PeckShield, Lava's smart contract suite was audited prior to launch, though the audit did not prevent subsequent exploits.","heading":"Protocol Overview","sources":[{"url":"https://cointelegraph.com/news/lava-decentralized-lending-mitigate-impermanent-loss","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/lava","name":"defillama.com","type":"other","credibility":3},{"url":"https://docs.lavadefi.io/transparency/contract-audits","name":"docs.lavadefi.io","type":"other","credibility":3},{"url":"https://lavadefi.io/","name":"lavadefi.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Lava Finance suffered two documented on-chain exploits in 2024, both on the Arbitrum chain and both classified as protocol logic vulnerabilities exploited via flash loans.\n\nThe first incident occurred on March 29, 2024, resulting in losses of approximately $340,000. The attack was initially reported by PeckShield Alert on March 28, 2024. Within 15 minutes of the report, the Lava team paused all lending markets. The exploit abused a calculation error in the protocol's liquidation engine via flash loans. Within an hour of the incident, the team coordinated with major exchanges to identify and flag the exploit address on Arbiscan, and law enforcement reports were filed. Affected addresses were compensated through an Insurance Fund independent of any attacker fund returns. The team issued an on-chain message to the attacker offering to halt investigations if 90% of user funds were returned. A post-mortem was published on HackMD on April 26, 2024, detailing the fix: an update to the _limitFees function to properly limit fees and claim pending protocol fees.\n\nA second exploit occurred on October 4, 2024, resulting in an additional $130,000 in losses. This incident triggered further unauthorized withdrawals despite mitigations implemented after the March event, indicating that the underlying protocol logic vulnerabilities were not fully remediated. Combined losses across both incidents total approximately $470,000.\n\nThe recurrence of an exploit using a similar attack vector approximately six months after the first incident raises questions about the completeness of the initial remediation.","heading":"Security Incidents and Exploit History","sources":[{"url":"https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://www.chainsec.io/defi-hacks","name":"chainsec.io","type":"other","credibility":3},{"url":"https://defillama.com/protocol/lava","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT flagged Lava Finance as a protocol of concern. ZachXBT is a widely cited blockchain forensics researcher whose investigations and warnings have preceded or accompanied numerous documented DeFi fraud and exploit cases. The specific nature and timing of the ZachXBT flag on Lava have not been independently confirmed through a publicly retrievable post or report as of the time of this investigation. The flag is reflected in the platform's current trust score of 55/100. ZachXBT has historically flagged protocols following exploit incidents, rug pulls, and evidence of insider manipulation. Users and researchers are encouraged to consult ZachXBT's public posts on X (@zachxbt) and his Mirror.xyz publication (zachxbt.mirror.xyz) for the most current state of any active investigation.","heading":"ZachXBT Flag","sources":[{"url":"https://zachxbt.mirror.xyz/","name":"zachxbt.mirror.xyz","type":"other","credibility":3},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","credibility":3},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"The $LAVA token has a stated fixed total supply of 1,000,000,000 tokens. Lava Finance claims the token and all associated smart contracts have been audited by PeckShield. The protocol states that all funds are held under multi-chain multisignature custody, asserting that no single party can access or transfer assets without quorum approval. However, the two successful exploit incidents suggest that smart contract safeguards did not operate as designed. No public evidence has emerged of SEC, CFTC, or other regulatory action specifically against Lava Finance (lavadefi.io) as of May 2026. The $LAVA token contract is traceable on Etherscan (0xd89c37fd7c0fa3b107b7e4a8731dd3aaec488954) and BscScan (0xfaff5251ea98f90540d6bacdf7a458f61b456c06). On-chain analysis of token distribution and holder concentration has not been independently published in any Tier 1 or Tier 2 source reviewed for this investigation.","heading":"Token and Governance Concerns","sources":[{"url":"https://docs.lavadefi.io/info/usdlava-token-summary","name":"docs.lavadefi.io","type":"other","credibility":3},{"url":"https://etherscan.io/token/0xd89c37fd7c0fa3b107b7e4a8731dd3aaec488954","name":"etherscan.io","type":"other","credibility":3},{"url":"https://bscscan.com/token/0xfaff5251ea98f90540d6bacdf7a458f61b456c06","name":"bscscan.com","type":"other","credibility":3},{"url":"https://docs.lavadefi.io/transparency/contract-audits","name":"docs.lavadefi.io","type":"other","credibility":3}],"severity":"medium"},{"content":"A separate but frequently conflated entity, Lava (lava.xyz), is a Bitcoin-backed lending fintech founded by Shehzan Maredia. This company raised $17.5 million in a Series A extension in 2025 backed by investors including former Visa and Blockchain.com executives, and subsequently raised $200 million in November 2025 from investors including Peter Thiel's Founders Fund, Khosla Ventures, and Susquehanna. Simultaneous with the $200 million announcement, users discovered that a September 2025 app update had silently migrated their funds from a self-custodial model based on Discreet Log Contracts (DLCs) — where users held one key in a two-of-two multisig — to a fully custodial arrangement where Lava holds funds in an institutional cold-storage wallet. Users reported being required to accept the update to retain access to existing loans, with no clear disclosure that the custody model was fundamentally changing. Coverage in Gizmodo described the change as a 'sneaky app update.' Jack Mallers, CEO of Strike, publicly questioned the regulatory legality of the pivot, stating: 'You can't just flip a switch from non-custodial to custodial and start offering brokerage, trading, or lending services.' An investigation by Protos found additional alleged misrepresentations: interest rates advertised at 5% that could allegedly reach 13%; stablecoin balances displayed as USD equivalents; and reliance on a single-party oracle for purportedly non-custodial services. Lava's terms of service at the time of the pivot still stated the company had 'no exclusive custody or control' over wallet contents, directly contradicting the announced operational change. CEO Maredia defended the shift by stating that 'custodial/non-custodial isn't really a binary...it's more of a spectrum,' and cited DLC technology risks including client-side key risk and oracle manipulation vulnerabilities.","heading":"Related Entity: Lava (lava.xyz) Bitcoin Lending Custody Controversy","sources":[{"url":"https://gizmodo.com/bitcoin-wallet-lava-removes-decentralization-via-sneaky-app-update-2000685725","name":"gizmodo.com","type":"other","credibility":3},{"url":"https://blockspace.media/insight/bitcoin-lending-app-lava-quietly-shifted-its-custody-model-users-are-demanding-answers/","name":"blockspace.media","type":"other","credibility":3},{"url":"https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","name":"bitcoinmagazine.com","type":"other","credibility":3},{"url":"https://protos.com/who-really-controls-lavas-bitcoin-collateral/","name":"protos.com","type":"other","credibility":3},{"url":"https://blockworks.com/news/lava-raise-17m-lending-platform","name":"blockworks.com","type":"other","credibility":3},{"url":"https://bitcoinmagazine.com/business/lava-raises-200m-for-bitcoin-backed-line-of-credit-announces-new-borrow-rates-starting-at-5","name":"bitcoinmagazine.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Lava Finance states that its smart contract suite was audited by PeckShield, one of the major blockchain security audit firms. PeckShield was also the party that first publicly reported the March 2024 exploit, meaning the auditing firm detected the attack in real time. The audit report itself is referenced in Lava's documentation but the specific audit findings, scope dates, and identified vulnerabilities are presented as embedded images in the documentation rather than accessible text, limiting independent verification. Despite the pre-launch audit, the protocol experienced two successful exploit incidents totaling $470,000. The recurrence of the October 2024 exploit, using flash loan and protocol logic techniques similar to the March 2024 attack, suggests the post-incident remediation was incomplete. No additional third-party security audits have been publicly cited as having been conducted between the two exploit incidents.","heading":"Audit and Security Posture","sources":[{"url":"https://docs.lavadefi.io/transparency/contract-audits","name":"docs.lavadefi.io","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://www.chainsec.io/defi-hacks","name":"chainsec.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Lava Finance (lavadefi.io) does not prominently disclose team members in its public-facing documentation or official website. The protocol is operated by Lava Ltd., a company registered in an undisclosed jurisdiction. By contrast, the related Bitcoin lending entity Lava (lava.xyz) is led by Shehzan Maredia, who serves as Founder, CEO, and CTO. Maredia previously worked on Google's Cloud AI Team as an engineer and built a recommendation algorithm at Shipt. He attended Duke University and founded several prior ventures including ContainIt (contact tracing), CrucialLearning (sold to VitalSmarts LLC), and Joinly. Prior to the self-custody controversy, Maredia publicly advocated against custodial crypto setups on X, making the lava.xyz pivot to custody a noted contradiction. The two Lava entities share similar branding and product positioning in the Bitcoin/DeFi lending space, contributing to public confusion about which entity is associated with the exploit incidents and the ZachXBT flag.","heading":"Team and Background","sources":[{"url":"https://www.crunchbase.com/person/shehzan-maredia-cfec","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://theorg.com/org/lava-2/org-chart/shehzan-maredia","name":"theorg.com","type":"other","credibility":3},{"url":"https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","name":"bitcoinmagazine.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-03-07","event":"Lava Finance (lavadefi.io) launches as a decentralized multichain lending and borrowing protocol on Arbitrum and Base.","source":""},{"date":"2024-03-28","event":"PeckShield Alert publicly reports an active exploit on Lava Finance. All lending markets are paused within 15 minutes.","source":""},{"date":"2024-03-29","event":"Lava Finance flash loan exploit confirmed. Approximately $340,000 lost via a protocol logic vulnerability in the liquidation engine. Law enforcement reports filed; attacker address flagged on Arbiscan.","source":""},{"date":"2024-04-26","event":"Lava Finance publishes a post-mortem on HackMD detailing the exploit, remediation steps including the _limitFees function fix, and Insurance Fund compensation for affected users.","source":""},{"date":"2024-10-04","event":"A second exploit targets Lava Finance on Arbitrum, resulting in approximately $130,000 in losses via a protocol logic flash loan attack, despite prior mitigations.","source":""},{"date":"2025-09","event":"Lava (lava.xyz) pushes an app update prompting users to migrate funds to new vaults, without disclosing the transition from self-custodial DLCs to a fully custodial cold-storage model.","source":"","date_original":"2025-09-01"},{"date":"2025-11-04","event":"Owen Kemeys of Foundation Devices publicly questions Lava's consent practices on X, triggering widespread media coverage of the custody model shift.","source":""},{"date":"2025-11-14","event":"Gizmodo, Bitcoin Magazine, Blockspace, and Protos publish investigations into Lava's custody model pivot. Jack Mallers raises regulatory legality concerns. Lava CEO Shehzan Maredia defends the change citing DLC technology risks.","source":""},{"date":"2025-11","event":"Lava (lava.xyz) announces $200 million in new funding from Founders Fund, Khosla Ventures, Susquehanna, and angels including Anthony Pompliano, concurrent with the custody controversy.","source":"","date_original":"2025-11-01"}],"sources_used":[{"url":"https://cointelegraph.com/news/lava-decentralized-lending-mitigate-impermanent-loss","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/lava","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251027162240/https://defillama.com/protocol/lava","credibility":3,"archive_timestamp":"2025-10-27T16:22:40+00:00"},{"url":"https://docs.lavadefi.io/transparency/contract-audits","name":"docs.lavadefi.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://lavadefi.io/","name":"lavadefi.io","type":"other","archive_url":"http://web.archive.org/web/20260417112211/https://lavadefi.io/","credibility":3,"archive_timestamp":"2026-04-17T11:22:11+00:00"},{"url":"https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260417182023/https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","credibility":3,"archive_timestamp":"2026-04-17T18:20:23+00:00"},{"url":"https://www.chainsec.io/defi-hacks","name":"chainsec.io","type":"other","archive_url":"http://web.archive.org/web/20260519074402/https://www.chainsec.io/defi-hacks","credibility":3,"archive_timestamp":"2026-05-19T07:44:02+00:00"},{"url":"https://zachxbt.mirror.xyz/","name":"zachxbt.mirror.xyz","type":"other","archive_url":"http://web.archive.org/web/20251025091919/https://zachxbt.mirror.xyz/","credibility":3,"archive_timestamp":"2025-10-25T09:19:19+00:00"},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"},{"url":"https://docs.lavadefi.io/info/usdlava-token-summary","name":"docs.lavadefi.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://etherscan.io/token/0xd89c37fd7c0fa3b107b7e4a8731dd3aaec488954","name":"etherscan.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://bscscan.com/token/0xfaff5251ea98f90540d6bacdf7a458f61b456c06","name":"bscscan.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://gizmodo.com/bitcoin-wallet-lava-removes-decentralization-via-sneaky-app-update-2000685725","name":"gizmodo.com","type":"other","archive_url":"http://web.archive.org/web/20251212192818/https://gizmodo.com/bitcoin-wallet-lava-removes-decentralization-via-sneaky-app-update-2000685725","credibility":3,"archive_timestamp":"2025-12-12T19:28:18+00:00"},{"url":"https://blockspace.media/insight/bitcoin-lending-app-lava-quietly-shifted-its-custody-model-users-are-demanding-answers/","name":"blockspace.media","type":"other","archive_url":"http://web.archive.org/web/20251114161643/https://blockspace.media/insight/bitcoin-lending-app-lava-quietly-shifted-its-custody-model-users-are-demanding-answers/","credibility":3,"archive_timestamp":"2025-11-14T16:16:43+00:00"},{"url":"https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","name":"bitcoinmagazine.com","type":"other","archive_url":"http://web.archive.org/web/20260419090459/https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","credibility":3,"archive_timestamp":"2026-04-19T09:04:59+00:00"},{"url":"https://protos.com/who-really-controls-lavas-bitcoin-collateral/","name":"protos.com","type":"other","archive_url":"http://web.archive.org/web/20260314201122/https://protos.com/who-really-controls-lavas-bitcoin-collateral/","credibility":3,"archive_timestamp":"2026-03-14T20:11:22+00:00"},{"url":"https://blockworks.com/news/lava-raise-17m-lending-platform","name":"blockworks.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinmagazine.com/business/lava-raises-200m-for-bitcoin-backed-line-of-credit-announces-new-borrow-rates-starting-at-5","name":"bitcoinmagazine.com","type":"other","archive_url":"http://web.archive.org/web/20260311013057/https://bitcoinmagazine.com/business/lava-raises-200m-for-bitcoin-backed-line-of-credit-announces-new-borrow-rates-starting-at-5","credibility":3,"archive_timestamp":"2026-03-11T01:30:57+00:00"},{"url":"https://www.crunchbase.com/person/shehzan-maredia-cfec","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://theorg.com/org/lava-2/org-chart/shehzan-maredia","name":"theorg.com","type":"other","archive_url":"https://web.archive.org/web/20260829142900/https://theorg.com/org/lava-2?p=shehzan-maredia","credibility":3,"archive_timestamp":"2026-08-29T14:29:00+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:33.730937+00:00","updated_at":"2026-08-30T05:14:08.061547+00:00"}}