Taiko Users Warned—$1.7M Lost in Bridge Breach
By John Nada·Jun 23, 2026·3 min read
Taiko's Ethereum layer-2 network suffered a $1.7M loss due to a security breach. Users were urged to withdraw funds amid concerns over compromised proof verification.
Taiko's Ethereum layer-2 network has become the latest victim in a series of crypto exploits, with BlockSec Phalcon estimating losses exceeding $1.7 million. The breach, linked to an exposed Raiko SGX enclave signing key, has compromised Taiko's chain state verification mechanism, leaving users in a precarious position.
The Taiko network, which uses zero-knowledge rollups to enhance transaction efficiency while maintaining compatibility with Ethereum, was co-founded by former Loopring CEO Daniel Wang. It debuted its mainnet in May 2024, aimed at providing dedicated data storage for Ethereum scalers. This was seen as a significant step in the evolution of Ethereum's scalability solutions, making the breach particularly concerning for its community.
According to Decrypt, Taiko urged users to immediately withdraw their funds from all bridges on its network. The developers confirmed that the underlying security assumptions of these bridges could no longer be trusted. The team is now coordinating with its Security Council and ecosystem partners to manage the situation and explore both technical and legal avenues. Taiko's security notice, issued on a Sunday, emphasized the urgency of withdrawing funds from the compromised bridges.
Trump Targets ABC—Lawsuit Looms Over Reflecting Pool Costs
Trump targets ABC with lawsuits over Reflecting Pool costs.
The breach raises significant concerns about Taiko's proof verification infrastructure. BlockSec Phalcon's preliminary analysis suggests that the attacker capitalized on a publicly accessible signing key on GitHub. This allowed them to register unauthorized SGX instances and generate fraudulent proofs, which were accepted by Taiko's verification contracts. The attacker then used these fraudulent proofs to trigger the release of Ethereum-based assets from the protocol's ERC20Vault, causing substantial financial loss.
The exposed SGX enclave signing key led to a potential breakdown of the SGX prover trust model. With the compromised key, attackers could register attacker-controlled SGX instances using the SgxVerifier.registerInstance, which opened the door to generating and accepting fraudulent proofs. This breach highlights the critical importance of securing sensitive cryptographic keys and maintaining rigorous oversight over their accessibility.
In a broader context, this incident is part of a troubling trend. April saw KelpDAO suffer a $292 million loss, attributed to North Korea's Lazarus Group. May brought an unauthorized minting scandal involving $77 million on Monad, with realized losses at $816,000. And earlier this month, Raydium faced a $1.34 million exploit. Overall, DeFi protocols have lost more than $840 million in just the first five months of the year.
As crypto continues its rapid evolution, security remains a critical challenge. For Taiko, the immediate focus is on damage control. But the broader implications for Ethereum layer-2 solutions are undeniable. Users and developers alike must rethink their trust models and verification processes to prevent such breaches in the future. The Taiko breach serves as a stark reminder of the vulnerabilities inherent in blockchain technologies and the constant need for vigilance and innovation in security practices.