A security exploit on the Kaspa blockchain's KRC-20 token standard allowed an attacker to move approximately 186 million ZEAL and 54.4 billion NACHO tokens without possessing the bridge wallet's private key by exploiting a signature verification flaw in an off-chain indexer, draining liquidity pools. Security researcher Shai Wyborski claims he had warned the Kasplex team about exactly this type of trust vulnerability before mainnet launch but was ignored, defunded, and attacked by community members.
A Kasplex KRC-20 indexer exploit on September 20 moved 186.4 million ZEAL and 54.4 billion NACHO tokens by accepting a public key without valid signature verification, though Kaspa L1 itself was not compromised. The incident prompted API suspension and renewed focus on KCC-20 as a native covenant-based token standard, while Kaspa ecosystem developments include SilverScript v1.0 smart contract language, x402 micropayment protocol, and ongoing DAGKnight improvements.