Skip to main content
AVOID.NET
Sign in

Taiko Bridge SGX Key Exploit (June 2026)

avoid.net/taiko-bridge-sgx-key-exploit-june-2026→38/100·82% conf.
[VERIFIED]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5sUkYC…UZpB

Summary

On June 22, 2026, Taiko's Ethereum L1 bridge was exploited for approximately $1.7 million after an RSA-3072 SGX enclave signing key for the Raiko prover stack was accidentally committed to a public GitHub repository. The attacker used the exposed key to register fraudulent SGX prover instances and forge cross-chain withdrawal proofs, draining USDC, USDT, ETH, and other tokens from the bridge and ERC20Vault contracts. Taiko paused bridge operations within hours, made all affected users whole within ten days, and reopened the bridge on July 2, 2026 following an independent security review.

Connected Entities

1 entities
Organizations
□Taiko Bridge SGX Key Exploit (June 2026)
Relationships
    Have evidence about Taiko Bridge SGX Key Exploit (June 2026)?

    Timeline(7 events)

    21 June 2026

    Attacker begins exploit sequence: registers two malicious SGX verifier instances (IDs 5 and 6) on Ethereum mainnet using the exposed RSA-3072 signing key from the taikoxyz/raiko GitHub repository.

    DARKNAVY Blog — Taiko Bridge Source-Signal Proof Forgery

    22 June 2026

    Attacker submits malicious checkpoint, calls Bridge.processMessage() ten times with forged message hashes, and releases approximately $1.7 million in USDC, USDT, crvUSD, ETH/WETH, and other tokens from the L1 Bridge and ERC20Vault contracts.

    DARKNAVY Blog; CoinDesk

    22 June 2026

    Taiko's Security Council pauses Bridge and ERC20Vault contracts by approximately 2 a.m. ET. Block production is halted. Team publicly urges users to withdraw remaining bridge funds and asks exchanges to suspend TAIKO deposits.

    CoinDesk

    22 June 2026

    TAIKO token declines more than 20% from midnight UTC price. Approximately 1.99 million TAIKO (roughly $189,000) moved by attacker to MEXC exchange.

    CoinDesk; CryptoTimes

    22 June 2026

    BlockSec (Phalcon) issues preliminary analysis identifying the exposed Raiko SGX enclave signing key on GitHub as the likely root cause. Quill Audits also publicly discloses analysis.

    CryptoTimes

    29 June 2026

    Taiko team outlines a four-stage recovery plan covering patching, reserve replenishment, independent security review, and controlled bridge reopening.

    CryptoBriefing

    2 July 2026

    Taiko bridge reopens under conservative withdrawal quotas after completing an independent security review. Security Council authorizes the final unpause. All affected users confirmed made whole. TAIKO token rises as much as 136% on the announcement.

    CoinDesk
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain12 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (3 events). 12 of 12 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 7/29/2026, 12:27:10 PM

    last updated: 8/27/2026, 4:07:11 PM

    4 views

    avoid.net — verified advice for a post-truth world