ChainCatcher report: The attacker exploited a signature validation bypass vulnerability in the off-chain indexer of Kasplex KRC-20, transferring 186 million ZEAL and 54.398 billion NACHO without holding the private key of the bridged custodial wallet. Through five forged transactions, the tokens were minted via the Igra Labs EVM layer and Kasplex L2, then sold into the Zealous Swap liquidity pool. The KAS-side value of the affected liquidity pools declined by 94% to 99.6%. Igra has suspended iKAS withdrawals to Kaspa L1 and Hyperlane transfers, and advised users to avoid bridging KRC-20 tokens, purchasing ZEAL or NACHO on L2 DEXs, and adding liquidity to the affected pools. The Kaspa L1 consensus and unbridged Igra assets remain unaffected. Zealous Swap stated that the operator must fix the indexer and re-index historical data, rejecting transactions with empty signatures, abnormal labels, or scripts remaining after OP_ENDIF.
Kasplex KRC-20 Signature Bypass Vulnerability Causes 99.6% Loss in ZEAL and NACHO Pools
ChaincatcherShare
Summary
Kasplex's KRC-20 signature validation bypass enabled attackers to mint 186 million ZEAL and 5.4398 billion NACHO tokens without access to private keys. The exploit prompted traders to rapidly sell off assets on Zealous Swap, causing liquidity pool values to decline by as much as 99.6%. Igra Labs has paused iKAS withdrawals to Kaspa L1 and Hyperlane, advising users to avoid bridging KRC-20 tokens and adding liquidity to affected pools. Traders analyzing support and resistance levels are monitoring for potential price rebounds, while crypto value investing advocates are urging patience. Zealous Swap is working to repair the off-chain indexer and reindex records to prevent future attacks.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.