Kasplex Indexer Bypass Drains $54 Billion in ZEAL, NACHO Tokens

An attacker exploited a vulnerability in Kasplex's KRC-20 indexer to drain two token pools, moving 186.4 million ZEAL and 54.4 billion NACHO without possessing their private keys.

The attack occurred on September 20, with the attacker sending five forged transactions that fooled the indexer into recognizing transfers as legitimate. The tokens were then sent back to the bridge custody address, minted on Igra Labs' EVM layer and Kasplex L2, and dumped into Zealous Swap liquidity pools.

Kaspa's layer one (L1) did not recognize the forged transactions, but the off-chain indexer did, allowing the attacker to bypass the private key requirement. The attack was only possible because the indexer allowed empty signatures and malformed tags in its reading of KRC-20 token instructions.

The affected pools lost between 94% and 99.6% of their KAS-side value, with Zealous Swap saying that operators need to patch the indexer and reindex its history to reject empty signatures and other malformed data.