An attacker exploited a signature verification bypass in the Kasplex KRC-20 off-chain indexer and moved 186 million ZEAL and 54.398 billion NACHO without holding the private key for the bridge custody wallet, according to ChainCatcher. The tokens were then minted through the Igra Labs EVM layer and Kasplex L2 using five forged transactions before being sold into Zealous Swap liquidity pools. On the KAS side, affected pools lost 94% to 99.6% of their value. In response, Igra suspended iKAS withdrawals to Kaspa Layer 1 and Hyperlane transfers. It also warned users not to bridge KRC-20 tokens, buy ZEAL or NACHO on L2 DEXs, or add liquidity to the related pools. Igra said Kaspa L1 consensus and unbridged Igra assets were not affected. Zealous Swap said the operator needs to fix the indexer, reindex historical records, and reject transactions with empty signatures, abnormal tags, or scripts that still contain data after OP_ENDIF.