Kasplex KRC-20 exploit drains ZEAL & NACHO!

Hey, welcome to Kaspa Daily Pulse, here's what the Kaspa community's been buzzing about today.

The biggest story, by far, was a critical exploit involving the Kasplex KRC-20 indexer. Reports shared in the community say an attacker moved roughly 186.4 million ZEAL and 54.4 billion NACHO from bridge custody without obtaining the custody private key. The attacker apparently exploited faulty authorization logic, where the indexer treated a public key as permission even though no valid signature was provided.

The important distinction is that this was described as an indexer and KRC-20 accounting failure, NOT a compromise of Kaspa’s core consensus or anyone’s seed phrase. Still, the consequences were serious. Liquidity pools were drained, trading was disabled in some places, and bridged ZEAL and NACHO became unbacked on layer one. Users were warned to treat every KRC-20 balance as unconfirmed and avoid buying, accepting, or bridging these tokens until a fix is confirmed. Moving tokens to another address or hardware wallet reportedly does not close the vulnerability.

The incident reignited the community’s long-running debate over layers, bridges, and ecosystem complexity. A loud portion of the chat argued for sticking with native KAS and building directly on layer one. Others said secure compatibility layers could still attract liquidity and users from EVM networks. Kasplex’s zkEVM faced heavy criticism, while Igra, Argent, and the upcoming KCC-20 standard were discussed as possible parts of a cleaner future architecture. The broad takeaway was simple: fragmentation and weak infrastructure create both security risks and reputational damage.

Meanwhile, DagKnight development is progressing, although no ETA was given. The update shared today said more contributors are joining, the effort is becoming better organized, and Coder’s working implementation is now being scrutinized, upgraded, improved, and hardened collectively.

Finally, KAS spent much of the discussion fighting around four cents. One quoted snapshot showed about 4.007 cents, up 4.3 percent over 24 hours, while another message later cited a fall toward 3.79 cents. Bulls remained confident about five cents, bears expected another drop, and the community strongly disagreed over whether the KRC-20 incident affected price action at all.

So, eventful day: serious KRC-20 damage, but no reported Kaspa core breach.

That's it for today's pulse. Let's see what tomorrow brings. Catch you then.