Skip to main content
Sign in

Taiko Bridge SGX Key Exploit (June 2026)

avoid.net/taiko-bridge-sgx-key-exploit-june-2026→38/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

On June 22, 2026, Taiko's Ethereum L1 bridge was exploited for approximately $1.7 million after an RSA-3072 SGX enclave signing key for the Raiko prover stack was accidentally committed to a public GitHub repository. The attacker used the exposed key to register fraudulent SGX prover instances and forge cross-chain withdrawal proofs, draining USDC, USDT, ETH, and other tokens from the bridge and ERC20Vault contracts. Taiko paused bridge operations within hours, made all affected users whole within ten days, and reopened the bridge on July 2, 2026 following an independent security review.

Connected Entities

1 entities · 10 linked investigations
Organizations
□Taiko Bridge SGX Key Exploit (June 2026)
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Q2 2026 DeFi Record Hack Wave·0Alephium Bridge·18Bunni Protocol·28BitGrail·2Shunda Park Scam Compound·0Trenton Johnston·0Chen Zhi / Prince Group·2
    Have evidence about Taiko Bridge SGX Key Exploit (June 2026)?

    Timeline(7 events)

    2026-06-21

    Attacker begins exploit sequence: registers two malicious SGX verifier instances (IDs 5 and 6) on Ethereum mainnet using the exposed RSA-3072 signing key from the taikoxyz/raiko GitHub repository.

    DARKNAVY Blog — Taiko Bridge Source-Signal Proof Forgery

    2026-06-22

    Attacker submits malicious checkpoint, calls Bridge.processMessage() ten times with forged message hashes, and releases approximately $1.7 million in USDC, USDT, crvUSD, ETH/WETH, and other tokens from the L1 Bridge and ERC20Vault contracts.

    DARKNAVY Blog; CoinDesk

    2026-06-22

    Taiko's Security Council pauses Bridge and ERC20Vault contracts by approximately 2 a.m. ET. Block production is halted. Team publicly urges users to withdraw remaining bridge funds and asks exchanges to suspend TAIKO deposits.

    CoinDesk

    2026-06-22

    TAIKO token declines more than 20% from midnight UTC price. Approximately 1.99 million TAIKO (roughly $189,000) moved by attacker to MEXC exchange.

    CoinDesk; CryptoTimes

    2026-06-22

    BlockSec (Phalcon) issues preliminary analysis identifying the exposed Raiko SGX enclave signing key on GitHub as the likely root cause. Quill Audits also publicly discloses analysis.

    CryptoTimes

    2026-06-29

    Taiko team outlines a four-stage recovery plan covering patching, reserve replenishment, independent security review, and controlled bridge reopening.

    CryptoBriefing

    2026-07-02

    Taiko bridge reopens under conservative withdrawal quotas after completing an independent security review. Security Council authorizes the final unpause. All affected users confirmed made whole. TAIKO token rises as much as 136% on the announcement.

    CoinDesk
    Provenance & Audit Trail
    12 Wayback Archives

    Decision Log

    • #1publish⛓ pending7/29/2026, 12:27:20 PM
      hash: JBYJiodPP2g84wsZU5f3bz7ZVmJQCqufQXKmQxT7CzBf

    12 of 12 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 7/29/2026, 12:27:10 PM

    last updated: 7/29/2026, 8:29:07 PM

    avoid.net — verified advice for a post-truth world