- Tweets 2,985
- Following 208
- Followers 1,036
- Likes 21,619
Chris retweeted
No matter where this journey takes us, I’m grateful we’re here together nacho-the-kat:native & kaspa:native family 💚
8
14
72
1,038
🚨 Community Update
Trading on ZealousSwap is now reopened on Igra L2.
The Kasplex KRC 20 indexer has been paused and the KAT Bridge routes from KRC 20 L1 to Igra and Kasplex L2 are closed, preventing additional unbacked KRC 20 supply from entering Igra.
We know ZEAL supply on the L2s was inflated as a result of the incident. While this issue did not originate from ZealousSwap, we are taking responsibility for dealing with its consequences as fairly as possible.
All trades that happened during and after the incident remain valid. This includes users who bought ZEAL at heavily discounted prices. We will not invalidate legitimate trades or penalize anyone for trading the market that existed at the time.
With the affected route now closed, we are comfortable reopening trading on Igra L2.
Kasplex L2 trading will remain paused for now while we continue working on the recovery plan.
9
21
78
4,530
Chris retweeted
I hope the entire $KAS world does appreciate Igra Team.
This is NOT how 99% of crypto teams react.
⚠️ Status update: what to do if you received unexpected iKAS on 21 September.
Short version:
if you received iKAS from any address on this list, please send it to the Igra DAO Governance contract: 0xB3300fcC2F3EF3DeCdF8B1f710c21666f33Cbf18
explorer.igralabs.com/accoun…
Long version:
The attacker behind the KRC-20 incident sent amounts of 5,000 to 10,000 iKAS to around 35 wallets that seemingly have nothing to do with the attack. This was done to make uninvolved users look connected to it.
You are not under suspicion. Anyone can send to any address and you could not have refused it. Your own funds are unaffected, and exits covered by your own balance and deposits will settle normally.
Funds originating from the attacker cannot be bridged out. The exit settlement operators settle against amounts traceable to your own deposits, so anything traced to the attacker's wallets will not be paid out.
These are stolen funds. Returning them is voluntary, takes one transaction, and costs you nothing you could otherwise use.
If you already moved or spent it, email team@igralabs.com and we'll help sort it out.
1
14
75
1,928
🚨 KRC 20 Incident: Complete Fund Trail
Yesterday we published the technical breakdown of how the KRC 20 indexer was exploited.
Today we are publishing the other half: where the money went.
We traced the proceeds from the forged transfers, through the bridges and liquidity pools, back onto Kaspa L1 and through the addresses used to move the funds.
The trail reaches identifiable exchange accounts, including KuCoin, while a significant portion of the iKAS remains trapped on Igra.
Every transaction in the report is public and can be verified independently.
Full report in comments.
8
19
90
5,273
Mr. / Mrs. Attacker: Be aware.
We have gathered a ton of evidence.
Act accordingly.
$KAS
🚨 KRC 20 Incident: Complete Fund Trail
Yesterday we published the technical breakdown of how the KRC 20 indexer was exploited.
Today we are publishing the other half: where the money went.
We traced the proceeds from the forged transfers, through the bridges and liquidity pools, back onto Kaspa L1 and through the addresses used to move the funds.
The trail reaches identifiable exchange accounts, including KuCoin, while a significant portion of the iKAS remains trapped on Igra.
Every transaction in the report is public and can be verified independently.
Full report in comments.
11
26
966
Regarding the recently discovered attacks on the KRC20 underlying protocol, we are conducting a detailed technical analysis and expect to provide further conclusions within 24 hours at the earliest.
The public API will be temporarily disabled. During this period, please suspend all KRC20-related operations (such as transfers).
26
27
113
17,185
Chris retweeted
We independently checked the transactions in this report and fully agree with @ZealousSwap's findings.
KAT Bridge behaved as designed: for KRC-20 it treats the @Kasplex indexer as the source of truth, and it minted on EVM only after that indexer reported a successful deposit. Routes are paused at the smart-contract level while we wait for a meaningful updates from @kasplex. The Vault signers keys, Relayers keys, Onboarder keys, and SC Admins keys were never accessed, the smart contracts were not hacked; the source of truth upstream (kasplex indexer) allowed forged transactions to remove liquidity from the vault without any valid signature.
We also audited the full KAT Bridge KRC-20 history. None of those mints used an empty-sig / OP_NOT / KASPLEX forge. The only transactions we found with that pattern are the ones in the ZealousSwap report ( vault outflows, not bridge mints or releases). Due to the structure of the possible forgeries we'll need to continue this research when a KRC20 indexer is available because not all possible forgery txn shapes require showing relation to the Bridge vault address on a kaspa explorer but they will in the indexer's oplist txn history.
Out of caution, KRC-721 bridge is paused as well. We have no evidence it was affected or targeted.
@ZealousSwap's incident report - drive.google.com/file/d/1X7j…
🚨 KRC 20 Indexer Signature Bypass: Incident Report
We have completed our analysis of the KRC 20 incident that affected ZEAL and other bridged assets.
Importantly, our investigation found no exploit in ZealousSwap, Igra, or Kaspa L1. All three operated as intended. The vulnerability was in the Kasplex KRC 20 indexer.
The report covers the signature bypass, how unauthorized KRC 20 balances were created, how they were bridged to L2, and the resulting impact on liquidity.
Full incident report in the reply.
2
11
34
2,225
@Igra_Labs reacted quickly and professional under immense pressure. Team is top notch in comparison.
1
4
122