Taiko Ethereum L2 Bridge
Summary
On June 22, 2026, Taiko — an Ethereum-equivalent layer-2 rollup — suffered a bridge exploit in which an attacker drained approximately $1.7 million from its L1 Bridge and ERC-20 vault by using an RSA-3072 Intel SGX signing key that had been committed in plaintext to the public taikoxyz/raiko GitHub repository. The attacker used the key to register as a legitimate prover, forge L2 state attestations, and execute fraudulent withdrawal transactions on Ethereum with no corresponding deposits on Taiko's chain. Taiko halted block production network-wide, froze affected contracts, and urged all users to exit every bridge on the network within approximately eight minutes of the attack being detected by Blockaid's monitoring system.
Connected Entities
1 entities · 10 linked investigationsTimeline(7 events)
2026-06-22
Attack begins: attacker uses leaked Intel SGX RSA-3072 enclave-key.pem from the public taikoxyz/raiko GitHub repository to register a rogue prover and begin submitting forged withdrawal proofs on Ethereum. Approximately $1.7 million drained from L1 Bridge and ERC20Vault contracts.
CoinDesk2026-06-22
Blockaid's automated monitoring system detects the exploit in real time. Taiko halts block production and freezes L1 Bridge and ERC20Vault withdrawals by approximately 2:08 a.m. ET — roughly eight minutes after the attack began.
SpotedCrypto2026-06-22
Taiko publicly urges all users to withdraw funds from all bridges deployed on the chain, requests centralized exchanges suspend TAIKO deposits, and activates the Security Council multisig governance body.
CoinDesk / BanklessTimes2026-06-22
Alleged attacker moves approximately 2 million TAIKO tokens (approximately $170,000) to a MEXC exchange account before the full freeze takes effect.
Thirdweb Blog / CryptoTimes2026-06-22
TAIKO token price falls approximately 10–20% intraday, with multiple outlets reporting an all-time low near $0.073.
CoinCodex2026-06-22
Recovery pull request 21820 opened at 17:09 UTC against the v3.0.0 protocol branch with four structural fixes: checkpoint versioning, Inbox state reset, bridge-message invalidation, and QuotaManager restoration.
SpotedCrypto2026-06-23
Additional security analysis published by TechTimes and other outlets confirming the SGX trust model was defeated by the plaintext key commit. Ledger CTO comments publicly attributing root cause to operational key management failure.
TechTimes / IncryptedDecision Log
- hash: eVrVUzp5gEpTzt8xZXwpk2hKtRMq5MSaLYQfDJi8THu
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 6/25/2026, 11:08:02 PM
last updated: 6/25/2026, 11:08:12 PM
avoid.net — verified advice for a post-truth world