Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #11[disputed][awaiting moderator]in section: Recovery Plan: PR #21820

   “As of the date of this investigation, PR #21820 remained open and unmerged.”

   reviewerAs of the date of this investigation, PR #21820 remained open and unmerged.The cited source (SpotedCrypto) reported an accurate open/unmerged status only as of its own publication around June 22-23; the page's sources_used include archive snapshots from late July 2026, well after the PR was actually merged (June 23) and the bridge reopened (July 2), so presenting this as current 'as of the date of this investigation' is factually wrong, not merely time-lagged.
   Proposed correction (not yet applied)

   PR #21820 was merged on June 23, 2026, one day after being opened.
   citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/
2. #12[disputed][awaiting moderator]in section: Recovery Plan: PR #21820

   “Bridge reopening is contingent on merging the fix, a post-merge security review, and Security Council multisig approval.”

   reviewerBridge reopening is contingent on merging the fix, a post-merge security review, and Security Council multisig approval.Same underlying staleness as the PR-merge finding: the bridge reopening the page frames as a future contingency had already occurred well before this review, and evidently before several of the page's own archived source snapshots (dated into late July 2026).
   Proposed correction (not yet applied)

   The bridge fully reopened on July 2, 2026, after the fix was merged, a post-merge security review, and Security Council multisig approval.
   citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/
3. #13[disputed][awaiting moderator]in the timeline

   “PR #21820 remains open and unmerged; bridge reopening pending merge, post-merge security review, and Security Council multisig approval.”

   reviewerPR #21820 remains open and unmerged; bridge reopening pending merge, post-merge security review, and Security Council multisig approval (timeline).Same defect as the two Recovery Plan section findings, repeated in the timeline's final entry. The timeline also has no later entry recording the actual merge or reopening, so the reader is left with a stale, contradicted end state.
   Proposed correction (not yet applied)

   PR #21820 was merged on June 23, 2026, and the bridge fully reopened on July 2, 2026, after a post-merge security review and Security Council multisig approval.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/

No source the reviewer could reach confirms or contradicts the claim.

1. #20[unverifiable][awaiting moderator]in section: Market and Token Impact

   “though recovery of those funds had not been publicly confirmed as of this investigation”

   reviewerRecovery of the approximately $170,000 in TAIKO tokens moved to MEXC had not been publicly confirmed as of this investigation.No source found either confirms or denies recovery of this specific tranche of funds; the page's hedge is appropriate given the ambiguous public record.

The claim was accurate when written but events since have overtaken it.

1. #14[stale][awaiting moderator]in section: Incident Overview

   “The TAIKO token declined approximately 10–20% following the announcement, briefly reaching an all-time low; the $1.7 million loss represented roughly 11.7% of TAIKO's approximately $14.5 million market capitalization at the time.”

   reviewerThe TAIKO token declined approximately 10-20% following the announcement, briefly reaching an all-time low.The June 22 low was likely a genuine new low at the time of the initial reporting, but it was itself superseded three days later; describing it flatly as 'an all-time low' without qualification is now inaccurate per the current on-record ATL.
   Proposed correction (not yet applied)

   The TAIKO token declined approximately 10–20% following the announcement, briefly reaching what was then a new low before an even lower all-time low of $0.06031 was recorded three days later, on June 25, 2026; the $1.7 million loss represented roughly 11.7% of TAIKO's approximately $14.5 million market capitalization at the time.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
2. #15[stale][awaiting moderator]in section: Market and Token Impact

   “with one report noting a price of $0.07294 at the low — an all-time low for the asset”

   reviewerOne report noted a TAIKO price of $0.07294 at the low, described as an all-time low for the asset.Same underlying issue as the summary/Incident Overview finding — the page never updates this claim to reflect the lower, later all-time low.
   Proposed correction (not yet applied)

   with one report noting a price of $0.07294 at the low — described at the time as an all-time low, though TAIKO fell further to a new all-time low of $0.06031 three days later, on June 25, 2026
   citedinvezz.com/news/2026/06/22/taiko-hits-al…oit-drains-1-7m/
3. #16[stale][awaiting moderator]in the timeline

   “TAIKO token price falls approximately 10–20% intraday, reaching an alleged all-time low of approximately $0.07294.”

   reviewerTAIKO token price falls approximately 10-20% intraday, reaching an alleged all-time low of approximately $0.07294 (timeline).Third occurrence of the same underlying defect; the timeline's use of 'alleged' hedges attribution but not currency, and does not flag that this specific price was superseded days later.
   Proposed correction (not yet applied)

   TAIKO token price falls approximately 10–20% intraday, reaching an alleged all-time low of approximately $0.07294; a lower all-time low of $0.06031 was recorded three days later, on June 25, 2026.
   citedinvezz.com/news/2026/06/22/taiko-hits-al…oit-drains-1-7m/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Incident Overview

   “On June 22, 2026, Taiko — an Ethereum-equivalent layer-2 rollup operated by Taiko Labs — suffered a bridge exploit resulting in an estimated $1.7 million in losses.”

   reviewerOn June 22, 2026, Taiko suffered a bridge exploit resulting in an estimated $1.7 million in losses.Date and loss figure are consistently corroborated across all outlets checked, including tier-1 CoinDesk and The Block.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10www.theblock.co/post/405486/taiko-confirms-exploit
2. #2[confirmed][no action needed]in section: Incident Overview

   “The attack targeted the L1 Bridge contract (0xd60247c6848B7Ca29eDdF63AA924E53dB6Ddd8EC) and the ERC20Vault contract (0x996282cA11E5DEb6B5D122CC3B9A1FcAAD4415Ab) deployed on Ethereum mainnet.”

   reviewerThe attack targeted the L1 Bridge contract (0xd60247c6848B7Ca29eDdF63AA924E53dB6Ddd8EC) and the ERC20Vault contract (0x996282cA11E5DEb6B5D122CC3B9A1FcAAD4415Ab).Addresses match the cited source exactly; the page separately (and correctly) discloses in the Affected Contracts section that these are not yet officially confirmed by Taiko.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
3. #3[confirmed][no action needed]in section: Root Cause: Exposed SGX Signing Key

   “Security researchers, including analysts at BlockSec, identified the root cause as an Intel SGX RSA-3072 private signing key (enclave-key.pem) that was publicly committed to the taikoxyz/raiko open-source GitHub repository.”

   reviewerSecurity researchers, including BlockSec, identified the root cause as a leaked Intel SGX RSA-3072 signing key (enclave-key.pem) publicly committed to the taikoxyz/raiko GitHub repository.Confirmed by two independent outlets naming BlockSec; one other outlet (CryptoTimes) instead attributes the technical writeup to Quill Audits, but does not contradict BlockSec's involvement — it simply doesn't mention BlockSec.
   citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/
4. #4[confirmed][no action needed]in section: Attack Mechanics

   “The attacker then signed fraudulent L2 state attestations and called processMessage() on the bridge contract, setting withdrawal statuses to RETRIABLE for messages that had no corresponding MessageSent events on Taiko's source chain.”

   reviewerThe attacker forged SGX attestations, called processMessage() to set withdrawal statuses to RETRIABLE for messages without corresponding MessageSent events, then called retryMessage() to release funds.Technical mechanics match the cited source's description of the exploit flow.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
5. #5[confirmed][no action needed]in section: Attack Mechanics

   “Prior to the freeze, the attacker moved approximately 2 million TAIKO tokens (approximately $170,000) to a MEXC exchange account.”

   reviewerPrior to the freeze, the attacker moved approximately 2 million TAIKO tokens (approximately $170,000) to a MEXC exchange account.Core fact (token count, destination exchange) confirmed by the cited source; the dollar estimate varies slightly (~$170k vs ~$189k) across outlets depending on the price snapshot used, which is not material.
   citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/
6. #6[confirmed][no action needed]in section: Detection and Immediate Response

   “The window between the attack beginning and containment was approximately eight minutes: the activity was detected and frozen between roughly 2:00 a.m. and 2:08 a.m. ET on June 22, 2026.”

   reviewerBlockaid detected the exploit and it was contained within roughly eight minutes, between approximately 2:00 a.m. and 2:08 a.m. ET on June 22, 2026.Detection window and Blockaid's role are consistently reported.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10www.banklesstimes.com/articles/2026/06/2…to-exit-bridges/
7. #7[confirmed][no action needed]in section: Detection and Immediate Response

   “Taiko's response included halting all block production, freezing L1 Bridge and ERC-20 Vault withdrawals, publicly urging all users to withdraw funds from all bridges deployed on the chain, requesting that exchanges suspend TAIKO token deposits, activating the project's Security Council multisig governance body, and committing to publish a full incident post-mortem.”

   reviewerTaiko's response included halting block production, freezing bridge/vault withdrawals, urging users to exit all bridges, requesting exchanges suspend TAIKO deposits, and activating the Security Council multisig.All listed response actions are independently corroborated.
   citedwww.banklesstimes.com/articles/2026/06/2…to-exit-bridges/
8. #8[confirmed][no action needed]in section: Affected Contracts

   “These addresses have been reported by CryptoTimes as the affected smart contracts; they have not yet been confirmed in an official Taiko post-mortem as of the date of this investigation.”

   reviewerThe Bridge and ERC20Vault addresses have been reported by CryptoTimes but not yet confirmed in an official Taiko post-mortem as of the investigation date.The page's caveat about lack of official confirmation is itself accurate and appropriately hedged.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
9. #9[confirmed][no action needed]in section: Affected Contracts

   “Remaining bridge funds were reported by the team as secure following the freeze.”

   reviewerRemaining bridge funds were reported by the team as secure following the freeze.Consistent with team statements at the time and with the later confirmed full 1:1 collateralization before reopening.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
10. #10[confirmed][no action needed]in section: Recovery Plan: PR #21820

    “The PR comprises 7 commits, 15 changed files, 485 additions, and 269 deletions, and bundles four structural fixes: (1) checkpoint versioning to invalidate all stored checkpoints and force re-derivation from a clean state; (2) an Inbox state reset that restores core chain state to a point before the attack; (3) bridge-message invalidation to void the fraudulent messages created during the exploit; and (4) QuotaManager restoration with per-window transfer limits (reportedly approximately $200,000 per 15-minute window) to cap potential future losses.”

    reviewerPR #21820 ('feat(protocol): port hack recovery hooks to v3') was opened June 22, 2026 at 17:09 UTC against the v3.0.0 branch, with 7 commits, 15 changed files, 485 additions, 269 deletions, and four structural fixes including a QuotaManager limit of approximately $200,000 per 15-minute window.PR mechanics and statistics are corroborated by both the cited secondary source and the primary GitHub PR itself.
    citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/
11. #17[confirmed][no action needed]in section: Incident Overview

    “the $1.7 million loss represented roughly 11.7% of TAIKO's approximately $14.5 million market capitalization at the time”

    reviewerThe $1.7 million loss represented roughly 11.7% of TAIKO's approximately $14.5 million market capitalization at the time.The $14.5M market-cap figure and derived percentage both check out against the tier-1 source.
    citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
12. #18[confirmed][no action needed]in section: Broader Context: Bridge Security in 2026

    “Analysts have reported that bridges have produced more than $340 million in losses across at least 14 exploits in 2026 as of the date of this incident, making bridges the single costliest attack surface in the crypto ecosystem.”

    reviewerBridges have produced more than $340 million in losses across at least 14 exploits in 2026 as of the date of this incident.The figures track a PeckShield tally from early June 2026; the page's hedged framing ('at least,' 'as of the date of this incident') is reasonable given the underlying count would only have grown by June 22.
    citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/
13. #19[confirmed][no action needed]in section: Broader Context: Bridge Security in 2026

    “Commentary from security researchers has highlighted that the damage was contained primarily because the team detected and froze activity within minutes, rather than because of any on-chain circuit breaker active at the time of the attack.”

    reviewerThe damage was contained primarily because the team detected and froze activity within minutes, rather than because of any on-chain circuit breaker active at the time of the attack.Matches the cited source's framing of manual response as the containment mechanism.
    citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/