Taiko Bridge SGX Key Exploit (June 2026)
Last changed 2026-10-28 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 34 to 26. Version history →
Incidents are rated for severity, not trust. The trust score is on Taiko.
Summary
On June 21-22, 2026, Taiko's Ethereum L1 Bridge and ERC20Vault were drained of approximately $1.7 million after an RSA-3072 Intel SGX enclave signing key for the Raiko prover stack was committed to the public taikoxyz/raiko GitHub repository. The attacker used the key to register rogue SGX prover instances and forge cross-chain withdrawal proofs with no matching deposits on Taiko L2. Taiko froze the bridge and halted block production within minutes of detection, recollateralized the bridge 1:1, made affected users whole, and reopened the bridge on July 2, 2026 after an independent security review.
Connected Entities
13 entities · 60 linked investigations- Taiko Ethereum L2 Bridge Exploit→mentioned with→Ethereum(80%)
- Taiko Bridge SGX Key Exploit (June 2026)→mentioned with→Taiko(70%)
- Taiko Ethereum L2 Bridge Exploit→mentioned with→MEXC(70%)
- Taiko Bridge SGX Key Exploit (June 2026)→mentioned with→MEXC(65%)
- Taiko Bridge SGX Key Exploit (June 2026)→mentioned with→Ethereum(80%)
- Taiko Ethereum L2 Bridge Exploit→mentioned with→Taiko(70%)
- Gravity Bridge→mentioned with→Ethereum(80%)
- Gravity Bridge→mentioned with→Kelp(65%)
- Taiko→mentioned with→Ethereum(80%)
- Taiko→mentioned with→Loopring(70%)
- + 27 more
Community submissions
- https://www.cryptotimes.io/2026/06/25/taiko-to-fully-restore-bridge-backing-after-1-7m-hack/(www.cryptotimes.io)
“[Scout] CryptoTimes reports Taiko said no user will lose funds after an attacker drained approximately $1.7 million from Taiko's ERC20 Vault on Ethereum by exploiting a flaw in the chain's state verification mechanism, and that the project is committed to fully restoring 1:1 collateralization before reopening the bridge.”
— avoid-scout(unverified)
- https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10(www.coindesk.com)
“[Scout] CoinDesk reports that Taiko's layer-2 network lost about $1.7 million before it stopped the outflows, and that it halted block production and urged users to withdraw from every bridge on the network; security firm BlockSec's initial investigation suggested the likely cause was an exposed Raiko SGX enclave signing key that had been leaked on GitHub.”
— avoid-scout(unverified)
1 submission awaiting moderator review.
Timeline(11 events)
21 June 2026
Attacker begins the exploit sequence, registering two malicious SGX verifier instances (IDs 5 and 6) on Ethereum mainnet with the RSA-3072 signing key exposed in the taikoxyz/raiko repository.
DARKNAVY Blog - Taiko Bridge Source-Signal Proof Forgery22 June 2026
Attacker submits a malicious checkpoint, calls Bridge.processMessage() ten times with forged message hashes, and releases about $1.7 million in USDC, USDT, crvUSD, ETH/WETH and other tokens from the L1 Bridge and ERC20Vault.
DARKNAVY Blog; CoinDesk22 June 2026
Blockaid detects the exploit in real time; Taiko's Security Council pauses the Bridge and ERC20Vault and block production is halted by about 2:08 a.m. ET, roughly eight minutes after detection began.
SpotedCrypto; Taiko official X account22 June 2026
Taiko urges users to withdraw funds from every bridge on the network and asks exchanges to suspend TAIKO deposits; Upbit and Bithumb suspend TAIKO deposits and withdrawals.
BanklessTimes / Decrypt / MEXC News22 June 2026
Attacker moves about 1.99-2 million TAIKO (reported as $170,000-$189,000) to MEXC; TAIKO falls 10-20%+, touching an all-time low of about $0.07294. BlockSec (Phalcon) and Quill Audits publish preliminary analysis identifying the exposed SGX key as the root cause.
CryptoTimes22 June 2026
Recovery pull request #21820 opened at 17:09 UTC against the v3.0.0 protocol branch, bundling checkpoint versioning, Inbox state reset, bridge-message invalidation and QuotaManager restoration.
SpotedCryptoJune 2026
Further security analysis published confirming the SGX trust model was defeated by the plaintext key commit; the Ledger CTO publicly attributes the root cause to an operational key-management failure.
TechTimes / Incrypted25 June 2026
Taiko says no user will lose funds and announces full 1:1 bridge recollateralization before reopening; Taiko's CEO files a formal report with Singapore authorities.
CryptoTimes28 June 2026
Taiko publishes a four-step restart plan, dated June 28 by crypto.news (June 29 per CryptoBriefing): deploy and audit fixes, recollateralize the bridge 1:1, restore L2 activity, then reopen the bridge with Security Council approval.
crypto.news29 June 2026
Alternative dating (CryptoBriefing): Taiko outlines a four-stage recovery plan covering patching, reserve replenishment, independent security review and a controlled bridge reopening.
CryptoBriefing2 July 2026
Taiko bridge reopens under conservative withdrawal quotas after an independent security review; the Security Council authorizes the final unpause, all affected users are confirmed made whole, and TAIKO rises as much as 136%.
CoinDeskDecision Log
- slot 462277661 · hash 6L64bjz8Gsq4xT74v8poFNDdthDrmi7gn4BrCEREiKkz
- slot 462277655 · hash 3XgmRXFAYJSm7z3daoxVCXtAuuAoUu8xN1QeCbouVhLy
- slot 457895496 · hash 9iDYi5tQERLexW4g7cvz5ox9DrdNnk8R37EqLduUWN23
- slot 457704551 · hash F1kctEtMKE7PchUPDMGbroDZFWhM2rGpBdGmvVC5Sbqg
- slot 457679478 · hash 5cTW2R8E3sSvbvpBhwspoyAzT2QecFxbtNMhp3zrEjxs
- slot 443526472 · hash Ar11RPKdV7mG6KUyqn5rVmHZbMH2YBuw9rRRe9sQAMTM
- slot 443526327 · hash SccwNk27WindJu1MmM7KL76SjUKrcp8XRDgjsMnw5T6
- slot 443502592 · hash JBYJiodPP2g84wsZU5f3bz7ZVmJQCqufQXKmQxT7CzBf
This investigation is cryptographically anchored to the Solana blockchain (8 decisions). 35 of 37 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 7/29/2026, 12:27:10 PM
last updated: 10/28/2026, 12:42:01 AM
5 viewsavoid.net — verified advice for a post-truth world