Kasplex KRC-20 Indexer Signature Bypass Drains Two Token Pools

An attacker drained 186.4 million ZEAL and 54.4 billion NACHO from a Kaspa KRC-20 bridge wallet without the private key, exploiting a signature bypass in the off-chain indexer. The tokens were recycled through L2 networks and sold into liquidity pools. Kaspa itself was not hacked.