That key must remain sealed within secure hardware so that evidence can be trusted. Once exposed, the attacker could enroll their own provers as legitimate and sign fraudulent proofs that Taiko’s verifier accepted, and then fake a bridging withdrawal that released real assets on Ethereum.
.@taikoxyz was allegedly attacked, with losses exceeding $1.7 million. Our initial investigation suggests that the likely root cause was a Raiko SGX enclave signing key exposed on GitHub. Raiko is Taiko’s multi-vendor stack for Taiko and Ethereum blocks, so an exposed Raiko SGX enclave key… pic.twitter.com/eAq9Xjngz8
– BlockSec Phalcon (@Phalcon_xyz) June 22, 2026
Taiko urged all users to withdraw from all network bridges, asked centralized exchanges to suspend deposits of its TAIKO token, and had its block producers stop manufacturing new blocks during the investigation.
At around 2 a.m. ET, it said the exploit was contained and withdrawals through the main bridge and token vault stopped completely. The exploiter had already transferred around 2 million TAIKO, worth approximately $170,000, to an account on the MEXC exchange.
The dollar loss is small, but the failure came from the same DeFi mechanism that has caused losses worth hundreds of millions this year.
Forged cross-chain messages drained $292 million from the Kelp DAO bridge in April and $11.4 million from the Verus-Ethereum bridge in May, the same failure where one chain is tricked into trusting a fake instruction from another. Bridges have produced more than $340 million in losses across at least 14 exploits in 2026, making them the costliest target in crypto. Taiko’s damage remained contained mainly because the team caught him and froze him within hours.
