That key’s meant to remain sealed inside safe {hardware} so the proofs will be trusted. With it uncovered, the attacker may enroll their very own provers as professional and signal fraudulent proofs that Taiko’s verifier accepted, then faux a bridge withdrawal that launched actual property on Ethereum.
.@taikoxyz was reportedly attacked, with losses exceeding $1.7M. Our preliminary investigation suggests the seemingly root trigger was an uncovered Raiko SGX enclave signing key on GitHub. Raiko is Taiko’s multi-prover stack for Taiko and Ethereum blocks, so an uncovered Raiko SGX enclave key… https://t.co/8BIiEeNtYJ pic.twitter.com/eAq9Xjngz8
— BlockSec Phalcon (@Phalcon_xyz) June 22, 2026
Taiko urged all customers to withdraw from each bridge on the community, requested centralized exchanges to droop deposits of its TAIKO token, and had its block producers cease making new blocks through the investigation.
By about 2 a.m. ET it stated the exploit was contained and withdrawals by way of the primary bridge and token vault have been absolutely stopped. The exploiter had already moved about 2 million TAIKO, price roughly $170,000, to an account on the MEXC change.
The greenback loss is small, however the flaw got here from the identical DeFi mechanism which have triggered a whole bunch of tens of millions price of losses this yr.
Cast cross-chain messages drained $292 million from Kelp DAO’s bridge in April and $11.4 million from the Verus-Ethereum bridge in Might, the identical failure the place one chain is tricked into trusting a faux instruction from one other. Bridges have produced greater than $340 million in losses throughout at the very least 14 exploits in 2026, making it the most expensive goal in crypto. Taiko’s injury stayed contained primarily as a result of the crew caught and froze it inside hours.

