Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #5[unverifiable][awaiting moderator]in section: Incident Overview

   “An official postmortem had been pledged by Taiko Labs but had not been published as of the date of this report.”

   reviewerAn official postmortem had been pledged by Taiko Labs but had not been published as of the date of the report.Could not locate a dedicated, published official Taiko postmortem document as of the review date; multiple secondary sources describe only a pledge to publish one. Genuinely unresolved rather than disputed.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10www.banklesstimes.com/articles/2026/06/2…to-exit-bridges/

The claim was accurate when written but events since have overtaken it.

1. #13[stale][awaiting moderator]in section: Recovery Plan: Pull Request 21820

   “As of the date of this investigation, the PR remained open and unmerged.”

   reviewerAs of the date of this investigation, PR 21820 remained open and unmerged.The cited SpotedCrypto source was accurate as of its own June 22-23 publication, but the page presents that snapshot as still current. The PR was merged the next day and the bridge was fully restored 10 days later; this section is now out of date.
   Proposed correction (not yet applied)

   As of the date of this investigation, the PR had been merged into the v3.0.0 protocol branch on June 23, 2026.
   citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/
2. #14[stale][awaiting moderator]in section: Recovery Plan: Pull Request 21820

   “Bridge reopening is contingent on the PR being merged, a post-merge security review, and Security Council multisig approval.”

   reviewerBridge reopening is contingent on the PR being merged, a post-merge security review, and Security Council multisig approval.Same underlying staleness as the preceding sentence: the condition described as pending has since been satisfied and publicly reported.
   Proposed correction (not yet applied)

   The bridge fully reopened on July 2, 2026, after the PR was merged, a post-merge security review, and Security Council multisig approval.
   citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/

The cited evidence supports part of the claim but not all of it.

1. #8[partially supported][awaiting moderator]in section: Attack Mechanics and On-Chain Activity

   “Because the bridge contracts' MrSigner verification is derived from the public counterpart of the exposed key, the forged prover was indistinguishable from an authorized one.”

   reviewerBecause the bridge contracts' MrSigner verification is derived from the public counterpart of the exposed key, the forged prover was indistinguishable from an authorized one.The general narrative (leaked key let the attacker register a rogue prover) is well supported by secondary press sources, but the specific MrSigner framing is a simplification not found in the more technical, primary forensic writeup, which instead points to a zero-delay instance-validity misconfiguration as the more precise proximate cause. The page's account is not wrong so much as incomplete on this technical point.
   citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/www.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
2. #18[partially supported][awaiting moderator]in section: Broader Context: Bridge Exploit Pattern in 2026

   “Security commentary has noted that damage was contained primarily because of rapid third-party detection and manual intervention rather than any on-chain circuit breaker active at the time of the attack.”

   reviewerDamage was contained primarily because of rapid third-party detection and manual intervention rather than any on-chain circuit breaker active at the time of the attack.The 'manual intervention over circuit breaker' framing is a reasonable synthesis consistent with reporting but is presented as an editorial characterization ('security commentary has noted') without a specific attributable quote, making it harder to verify as a discrete, sourced claim rather than the page's own analysis.
   citedcryptodaily.co.uk/2026/06/taiko-bridge-e…defi-safety-test

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “On June 22, 2026, Taiko — an Ethereum-equivalent layer-2 rollup — suffered a bridge exploit in which an attacker drained approximately $1.7 million from its L1 Bridge and ERC-20 vault by using an RSA-3072 Intel SGX signing key that had been committed in plaintext to the public taikoxyz/raiko GitHub repository.”

   reviewerOn June 22, 2026, Taiko suffered a bridge exploit draining approximately $1.7 million from its L1 Bridge and ERC-20 vault via a leaked RSA-3072 Intel SGX signing key.Core facts (amount, date as reported by press, root-cause key leak) are corroborated by multiple independent outlets. Note: a specialized on-chain forensic writeup (DarkNavy) timestamps the actual Ethereum release transactions at 2026-06-21 19:03-22:18 UTC, a day earlier than the press-reported June 22 date; see coverage_gaps.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10www.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
2. #2[confirmed][no action needed]in the summary

   “The attacker used the key to register as a legitimate prover, forge L2 state attestations, and execute fraudulent withdrawal transactions on Ethereum with no corresponding deposits on Taiko's chain.”

   reviewerThe attacker registered as a legitimate SGX prover using the leaked key, forged L2 state attestations, and executed fraudulent withdrawals with no corresponding deposits on Taiko's chain.Confirmed by both press coverage and an independent technical on-chain forensic analysis.
   citedthedefiant.io/news/hacks/taiko-bridge-ex…-key-github-1-7m
3. #3[confirmed][no action needed]in the summary

   “Taiko halted block production network-wide, froze affected contracts, and urged all users to exit every bridge on the network within approximately eight minutes of the attack being detected by Blockaid's monitoring system.”

   reviewerTaiko halted block production, froze affected contracts, and urged users to exit all bridges within approximately eight minutes of Blockaid detecting the attack.Corroborated directly by the page's tier-1 cited source.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
4. #4[confirmed][no action needed]in section: Incident Overview

   “suffered a bridge exploit resulting in an estimated $1.7 million in losses from its L1 Bridge contract (0xd60247c6848B7Ca29eDdF63AA924E53dB6Ddd8EC) and ERC20Vault contract (0x996282cA11E5DEb6B5D122CC3B9A1FcAAD4415Ab) on Ethereum mainnet.”

   reviewerThe L1 Bridge and ERC20Vault contract addresses are 0xd60247c6848B7Ca29eDdF63AA924E53dB6Ddd8EC and 0x996282cA11E5DEb6B5D122CC3B9A1FcAAD4415Ab respectively.Both contract addresses were verified directly against Etherscan's labeled contract pages.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
5. #6[confirmed][no action needed]in section: Root Cause: SGX Signing Key Committed to Public GitHub Repository

   “Security firms BlockSec (via its Phalcon monitoring arm) and Quill Audits independently identified the root cause as an Intel SGX RSA-3072 private signing key stored in a file named enclave-key.pem that had been committed in plaintext to the public taikoxyz/raiko GitHub repository.”

   reviewerBlockSec (via Phalcon) and Quill Audits independently identified the root cause as the leaked enclave-key.pem SGX signing key committed to the public taikoxyz/raiko repository.Both attributions independently corroborated across multiple outlets.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
6. #7[confirmed][no action needed]in section: Root Cause: SGX Signing Key Committed to Public GitHub Repository

   “The Ledger CTO and other security researchers who commented publicly on the incident characterized the failure as an operational key management error rather than a flaw in the SGX or Raiko protocol designs themselves.”

   reviewerThe Ledger CTO and other security researchers characterized the failure as an operational key management error rather than a flaw in SGX/Raiko protocol design.Directly supported by the cited source.
   citedincrypted.com/en/ledger-cto-private-key-…used-taiko-hack/
7. #9[confirmed][no action needed]in section: Attack Mechanics and On-Chain Activity

   “In the second stage, the attacker called processMessage() on the L1 Bridge contract, setting withdrawal message statuses to RETRIABLE for messages that had no corresponding MessageSent events on Taiko's source chain — meaning no actual deposits had been made on L2.”

   reviewerThe attacker called processMessage() to set withdrawal statuses to RETRIABLE for messages with no corresponding MessageSent events, then used retryMessage() to release funds.Confirmed at the technical level by an independent forensic analysis, not just secondary press summaries.
   citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/
8. #10[confirmed][no action needed]in section: Attack Mechanics and On-Chain Activity

   “Prior to the freeze, the attacker moved approximately 2 million TAIKO tokens (approximately $170,000) to an account on the MEXC exchange.”

   reviewerPrior to the freeze, the attacker moved approximately 2 million TAIKO tokens (approximately $170,000) to an account on MEXC exchange.Figures are in the same ballpark across sources; minor variance likely reflects different price snapshots.
   citedwww.cryptotimes.io/2026/06/22/1-7m-gone-…igning-key-leak/
9. #11[confirmed][no action needed]in section: Detection and Immediate Response

   “Blockaid's automated exploit detection system identified the attack in real time, with the activity detected and frozen between approximately 2:00 a.m. and 2:08 a.m. ET on June 22, 2026 — an interval of approximately eight minutes.”

   reviewerBlockaid detected the attack in real time, with activity detected and frozen between approximately 2:00 and 2:08 a.m. ET, and Taiko published the attacker's known wallet addresses.Directly corroborated by the cited tier-1 source and independently by a second outlet regarding wallet address publication.
   citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
10. #12[confirmed][no action needed]in section: Recovery Plan: Pull Request 21820

    “On June 22, 2026 at 17:09 UTC, Taiko developers opened recovery pull request 21820 against the v3.0.0 protocol branch of the taikoxyz/taiko-mono repository. The PR spans 15 changed files with 485 additions and 269 deletions and bundles four structural fixes”

    reviewerRecovery pull request 21820 was opened June 22, 2026 at 17:09 UTC against the v3.0.0 branch, spans 15 changed files with 485 additions and 269 deletions, and bundles four fixes (checkpoint versioning, Inbox state reset, bridge-message invalidation, QuotaManager restoration at ~$200,000/15-minute window).PR metadata matches the cited source exactly.
    citedwww.spotedcrypto.com/taiko-bridge-exploit-june-2026/
11. #15[confirmed][no action needed]in section: Incident Overview

    “The TAIKO token fell approximately 10–20% on the news, briefly touching an all-time low near $0.073.”

    reviewerThe TAIKO token fell approximately 10-20% on the news, briefly touching an all-time low near $0.073.The exact low-price figure varies by a few cents across trackers ($0.06-$0.073) depending on exchange/measurement window, which the page appropriately hedges with 'near' and, in the Market Impact section, explicitly acknowledges divergent measurement windows for the percentage decline.
    citedcoincodex.com/article/86299/ethereum-lay…-token-falls-11/
12. #16[confirmed][no action needed]in section: Incident Overview

    “The $1.7 million loss represented approximately 11.7% of TAIKO's roughly $14.5 million market capitalization at the time of the incident.”

    reviewerThe $1.7 million loss represented approximately 11.7% of TAIKO's roughly $14.5 million market capitalization at the time of the incident.Both inputs to the percentage calculation are independently corroborated and the arithmetic is correct.
    citedwww.coindesk.com/tech/2026/06/22/taiko-h…t-token-dives-10
13. #17[confirmed][no action needed]in section: Broader Context: Bridge Exploit Pattern in 2026

    “Analysts have reported more than $340 million in bridge losses across at least 14 exploits in 2026 as of the date of this incident, making bridges the single costliest attack surface in crypto.”

    reviewerAnalysts have reported more than $340 million in bridge losses across at least 14 exploits in 2026 as of the date of the incident.Figure independently corroborated by at least two additional outlets beyond the page's own cited source.
    citedblog.thirdweb.com/taiko-bridge-exploit-e…ged-withdrawals/