Kasplex KRC-20 Indexer Flaw Lets Attacker Drain ZEAL and NACHO Liquidity Pools

An attacker exploited a signature verification bypass in the Kasplex KRC-20 off-chain indexer to transfer 186 million ZEAL and 54.398 billion NACHO without holding the private key for the bridge custodial wallet. According to ChainCatcher, the tokens were minted through five forged transactions via the Igra Labs EVM layer and Kasplex L2 before being sold into Zealous Swap liquidity pools, causing KAS-side losses of 94% to 99.6% in the affected pools. Igra has suspended iKAS withdrawals to Kaspa L1 and Hyperlane transfers, and warned users not to bridge KRC-20 tokens, buy ZEAL or NACHO on L2 DEXs, or add liquidity to the related pools. Kaspa L1 consensus and unbridged Igra assets were not affected, while Zealous Swap said operators need to fix the indexer, reindex historical records, and reject transactions with empty signatures, abnormal tags, or scripts remaining after OP_ENDIF.