Number of affected users is not confirmedNot confirmed
Group joining is coming soon.
Investigation
80%
Facts and investigation
Ledger
Attacker
14 addresses officially tagged by Igra Labs' Blockscout explorer as "Kasplex KRC-20 Exploiter 1" through "14" (notably Exploiter 11: 0x49D665B10Bd7b50F347622CDc677B3872De583Cf; Exploiter 13: 0xC03980C151a75129015a6a3D1EFdbB60e7B05C82; Exploiter 14: 0xfe2B772ADfEFcfa7863ACedD9A0F0D10208012C3)
Funds moved to
Igra DAO Governance recovery contract: 0xB3300fcC2F3EF3DeCdF8B1f710c21666f33Cbf18. Of the ~1.97M iKAS extracted: 1,000,000 iKAS blocked in escrow (withdrawal never paid out), 723,999.92 iKAS voluntarily returned, 20,500 iKAS withheld from bridge payouts, remainder (~205,692 iKAS + 6,500 WiKAS + 541.92 USDC) still outside recovery as of last check.
Linked
Exploited the Kasplex KRC-20 indexer's signature-verification bypass to mint and dump unbacked ZEAL (186,425,259 tokens) and NACHO (54,397,983,246 tokens) via Igra Labs' EVM bridge and Zealous Swap. Amount figure is based on Igra Labs' own September 26 disclosure of ~1.97M iKAS drained from Igra pools; this may represent only the Igra-bridge portion of the total KRC-20 preimage, not necessarily the full incident value. USD conversion uses a current iKAS spot price approximation, not a confirmed historical price at time of exploit.
Chronology
1 beat
On September 20, 2026, an attacker exploited a signature-verification bypass in the Kasplex KRC-20 off-chain indexer to forge transactions minting large quantities of ZEAL and NACHO tokens, which were then dumped via Igra Labs' EVM bridge and sold on Zealous Swap, collapsing both tokens' value. Igra Labs suspended iKAS-to-Kaspa withdrawals as a containment measure. On September 26, 2026, Igra Labs published a detailed fund-tracing thread confirming ~1.97M iKAS drained from Igra pools, with roughly 88.5% either blocked in escrow or voluntarily returned by the attacker and other wallets. A DAO governance process is underway to determine distribution of recovered funds to affected users, pending legal review.
