Kasplex KRC-20 Indexer Bypass Drains ZEAL and NACHO Pools

An attacker exploited a flaw in the off‑chain Kasplex indexer that tracks KRC‑20 tokens on the Kaspa network. By submitting transactions with an empty signature that the indexer accepted, the attacker moved 186,425,259 ZEAL and 54,397,983,246 NACHO from a bridge custody address without possessing its private key.

How the Forgery Worked

KRC‑20 token ownership is enforced by an off‑chain indexer, not by Kaspa’s consensus layer. The attacker crafted a transaction that contained the usual public key and token instructions but replaced the signature with an empty one and added an OP_NOT after OP_ENDIF. The empty signature caused OP_CHECKSIG to return false; the added OP_NOT flipped the result back to true, allowing the transaction to be accepted by the L1 consensus.

The indexer, however, did not enforce the canonical script format and recorded the forged transfer as legitimate. Its API even returned a success flag for the first forged ZEAL transaction.

Impact on Liquidity Pools

After the forged transfers, the attacker sent the tokens back to the bridge custody address as ordinary deposits, minted them on Igra Labs’ EVM layer and Kasplex L2, and dumped them into Zealous Swap liquidity pools. The pools lost between 94 % and 99.6 % of their KAS‑side value.

Response from Igra Labs and Zealous Swap

Igra Labs paused iKAS exits to Kaspa L1 and Hyperlane transfers and warned users against bridging KRC‑20 tokens, buying ZEAL or NACHO on L2 DEXs, or adding liquidity to the affected pools. Native KAS and non‑bridged assets were reported as unaffected.

Zealous Swap announced that operators must patch the indexer to reject empty signatures, malformed tags, and scripts that extend beyond OP_ENDIF, then re‑index the history.

Future Directions

The community plans to adopt the KCC‑20 standard, which embeds token rules directly into scripts enforced by the network, aiming to prevent similar off‑chain indexing vulnerabilities.

Broader Context

This incident follows a series of recent exploits affecting custodial and non‑custodial services, including attacks on Blink Wallet and DCENT App wallets, highlighting an uptick in cybersecurity incidents across the crypto ecosystem.