Kasplex KRC-20 bridge/indexer flaw lets attacker drain ZEAL and NACHO liquidity pools
first published 2026-09-21T10:30:00Z
An attacker exploited a Kaspa KRC-20 bridge/indexer weakness by forging valid-looking transactions with empty signatures, moving 186.4 million ZEAL and 54.4 billion NACHO without the bridge wallet’s private key. The tokens were recycled through L2 networks and dumped into Zealous Swap pools, which lost up to 99.6% of their KAS-side value. Kaspa’s base chain was not hacked, but bridged assets became unbacked while operators paused exits and prepared a patch and reindex.
AI Analysis
The summary describes an exploit that drained token pools, left bridged assets unbacked, and caused up to 99.6% value loss in liquidity pools, which is strongly negative and market-moving.
Expected Investor Sentiment: Very Bearish
Potential Market Impact: Significant
