Kaspa KRC-20 Indexer Bypass Drains 186.4M ZEAL and 54.4B NACHO

Bridge validation failure triggers token drain

A Kaspa-based KRC-20 bridge suffered a significant token drain over the weekend after an attacker removed 186.4 million ZEAL and 54.4 billion NACHO without possessing the wallet’s private key. The incident reportedly involved five transactions that were valid on-chain but improperly accepted by an off-chain indexer. Kaspa itself was not hacked, placing the apparent failure within the bridge’s indexing and validation layer rather than its underlying blockchain.

After extracting the assets, the attacker moved them through layer-two networks and sold them into liquidity pools. That sequence suggests an effort to monetize the holdings quickly, although the available report does not provide a dollar valuation, current recovery status or measured price impact. The incident should therefore be assessed primarily by the quantities removed and the affected market infrastructure.

Key points

• 186.4 million ZEAL and 54.4 billion NACHO were removed from a bridge wallet.
• Five valid transactions bypassed the controls expected from the off-chain indexer.
• No compromise of the Kaspa base layer has been reported.
• The tokens were routed through layer-two networks before being sold into pools.
• The event highlights the security risks created by bridge dependencies beyond the blockchain itself.

Why this was not a Kaspa base-layer hack

A transaction can be valid under a blockchain’s consensus rules without satisfying every authorization policy used by an application built on top of that chain. In this case, the reported behavior indicates a mismatch between on-chain transaction validity and the bridge’s expected signature or permission checks. The indexer appears to have treated the five transactions as acceptable even though the attacker did not control the relevant private key.

That distinction matters. The incident should not be characterized as theft of a bridge operator’s signing key or as a break in Kaspa’s consensus security. It instead points to a potential control failure in the off-chain software responsible for interpreting blockchain activity and supporting bridge operations. Such components can become critical trust boundaries, particularly when they influence whether assets are released or recognized.

Market impact analysis

The most immediate pressure is likely concentrated in ZEAL and NACHO. Selling unauthorized balances into liquidity pools can sharply alter pool ratios, reduce exit liquidity and force prices to reprice with greater slippage. Liquidity providers may face temporary imbalance, while token holders could encounter weaker market depth even after the initial selling subsides.

Moving the proceeds through layer-two networks may complicate operational response and fund tracking, although additional routing does not by itself make blockchain activity untraceable. The wider altcoin market may also see a cautious reaction because indexer and bridge exploits tend to weaken confidence in cross-chain infrastructure. There is no reported evidence of direct exposure for Bitcoin or Ethereum, so any broader impact would likely be sentiment-driven rather than technical.

Outlook

The bridge operator’s priorities should include isolating affected flows, reconciling on-chain balances against indexer records, preserving transaction evidence and commissioning an independent review of signature verification and transaction-acceptance logic. Layer-two services and venues receiving the tokens may also need to coordinate if mitigation or recovery efforts are technically possible.

For users, the affected bridge interfaces should be considered unsafe until an official audit and remediation notice are available. The long-term consequences will depend on how much value can be recovered, how deeply the tokens were distributed and whether the same indexing flaw affects other deployments. At minimum, the episode reinforces that strong base-layer security cannot compensate for weak application infrastructure: off-chain indexers must use fail-closed validation, rigorous testing and transparent monitoring to prevent valid-looking transactions from becoming unauthorized withdrawals.

Source: Bitcoin.com News