An attacker exploited a signature verification bypass in the Kasplex KRC-20 off-chain indexer and moved 186 million ZEAL and 54.398 billion NACHO without holding the private key for the bridge custody wallet, according to ChainCatcher. The tokens were then minted through the Igra Labs EVM layer and Kasplex L2 using five forged transactions before being sold into Zealous Swap liquidity pools. On the KAS side, affected pools lost 94% to 99.6% of their value. In response, Igra suspended iKAS withdrawals to Kaspa Layer 1 and Hyperlane transfers. It also warned users not to bridge KRC-20 tokens, buy ZEAL or NACHO on L2 DEXs, or add liquidity to the related pools. Igra said Kaspa L1 consensus and unbridged Igra assets were not affected. Zealous Swap said the operator needs to fix the indexer, reindex historical records, and reject transactions with empty signatures, abnormal tags, or scripts that still contain data after OP_ENDIF.
An attacker exploited a signature verification bypass in the Kasplex KRC-20 off-chain indexer and moved 186 million ZEAL and 54.398 billion NACHO without holding the private key for the bridge custody wallet, according to ChainCatcher.
The attacker used five forged transactions to mint the tokens through the Igra Labs EVM layer and Kasplex L2, then sold them into Zealous Swap liquidity pools. The KAS-side value of the affected pools fell by 94% to 99.6%.
Igra suspends transfers and issues warning
Igra has suspended iKAS exits to Kaspa L1 and Hyperlane transfers. It also warned users to avoid bridging KRC-20 tokens, buying ZEAL or NACHO on L2 DEXs, and adding liquidity to the related pools.
Igra said Kaspa L1 consensus and unbridged Igra assets were not affected.
Zealous Swap outlines remediation steps
Zealous Swap said the operator needs to fix the indexer and reindex historical records, while rejecting transactions with empty signatures, abnormal tags, and scripts that still contain content after OP_ENDIF.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
