A KRC-20 indexer vulnerability in Kasplex allowed forged transactions to drain liquidity from the KAT Bridge vault without valid signatures, affecting bridged assets like ZEAL. Separately, CS2 scammers tricked users into deploying fake trading bots via YouTube tutorials, resulting in 224 drained inventories totaling $862,000.
A critical vulnerability in Kasplex's KRC-20 off-chain indexer allowed an attacker to create unauthorized token balances and drain liquidity pools, affecting tokens like ZEAL and NACHO. Igra Labs reported the loss of bridge custody holdings, prompting ZealousSwap to warn users and several bridging services to pause operations. The exploit impacts only the indexer infrastructure, not Kaspa's Layer 1 consensus.