NACHO / OCTOBER 2026
What Happened. What Changed.
On September 20, 2026, an attacker exploited a security flaw in the Kasplex KRC-20 indexer. The exploit allowed unauthorized transfers and created additional NACHO across supported networks.
The vulnerability was in the Kasplex KRC-20 indexer - not in the Kaspa network or KAT Bridge.
What Happened to the Supply?
NACHO launched with a maximum supply of 287 billion tokens.
Following the attack, the combined supply across three environments - KRC-20, Igra L2, and Kasplex L2 - exceeded the original amount.
As part of the transition to KCC-20, the community announced a starting supply of 330 billion NACHO.
Some legitimate holders had bridge transactions caught mid-transfer when operations stopped. We reached out directly to affected holders to work toward a fair resolution and collectively they volunteered to forgo over 6B in NACHO recovery.
The additional tokens increased NACHO’s total supply, causing dilution.
What Happened to the Funds?
The attacker sold the additional NACHO on decentralized exchanges, significantly impacting liquidity and putting pressure on market prices.
Some funds were withdrawn, but Igra managed to intercept approximately 87% of the attacker's proceeds on its network.
Legal proceedings were initiated to recover the intercepted funds. Intercepting funds does not mean they have been returned to affected users.
The Move to KCC-20
Following the incident, the community voted to move NACHO to KCC-20, the covenant-based token standard on Kaspa.
The old KRC-20 bridge routes were retired. Migration from KRC-20, Igra L2 and Kasplex L2 to KCC-20 was designed as a one-way process. The standard conversion ratio is 1:1, with the option to voluntarily burn a portion of the tokens during migration.
The community approved a 90-day migration window. The decision was also intended to reduce bridge operating costs and limit the risk of further security exploits involving the legacy KRC-20 indexer.
Under these rules, the option to migrate NACHO to KCC-20 closes when the window ends. Tokens that were not migrated remain on their original networks, and cannot be migrated to KCC-20 afterward.
Reducing the Excess Supply
Alongside the move to KCC-20, several measures were set out to reduce the excess supply:
- NFT Auctions: NACHO collected from auction sales was designated for token burns.
- Buybacks & Burns: Migration-related revenue was earmarked for buying and burning NACHO.
- Voluntary Burns: Holders were offered the option to burn some of their tokens as part of migration.
The goal: reduce the excess supply while keeping the transition fair for holders.
KCC-20 Migration
The 90-day migration window closes on
Migration is not automatic. Holders can complete the transfer using the official migration tool before the closing time.
Only this covenant ID is official KCC-20 NACHO. Always verify it.41d44970ba6307bcec418f677fd253778d0ffa47750d179dff647061aa6c0d40 kascovOne community. One path forward.