
That secret is meant to remain sealed inside safe {hardware} so the proofs might be trusted. With it uncovered, the attacker may enroll their very own provers as legit and signal fraudulent proofs that Taiko’s verifier accepted, then faux a bridge withdrawal that launched actual property on Ethereum.
.@taikoxyz was reportedly attacked, with losses exceeding $1.7M. Our preliminary investigation suggests the seemingly root trigger was an uncovered Raiko SGX enclave signing key on GitHub. Raiko is Taiko’s multi-prover stack for Taiko and Ethereum blocks, so an uncovered Raiko SGX enclave key… https://t.co/8BIiEeNtYJ pic.twitter.com/eAq9Xjngz8
— BlockSec Phalcon (@Phalcon_xyz) June 22, 2026
Taiko urged all customers to withdraw from each bridge on the community, requested centralized exchanges to droop deposits of its TAIKO token, and had its block producers cease making new blocks throughout the investigation.
By about 2 a.m. ET it mentioned the exploit was contained and withdrawals by means of the principle bridge and token vault have been absolutely stopped. The exploiter had already moved about 2 million TAIKO, price roughly $170,000, to an account on the MEXC change.
The greenback loss is small, however the flaw got here from the identical DeFi mechanism which have prompted a whole lot of hundreds of thousands price of losses this yr.
Cast cross-chain messages drained $292 million from Kelp DAO’s bridge in April and $11.4 million from the Verus-Ethereum bridge in Might, the identical failure the place one chain is tricked into trusting a faux instruction from one other. Bridges have produced greater than $340 million in losses throughout at the least 14 exploits in 2026, making it the most expensive goal in crypto. Taiko’s injury stayed contained primarily as a result of the crew caught and froze it inside hours.
