An attacker drained $1.7 million from Taiko's Ethereum Layer 2 bridge on June 22, exploiting a signing key left in the project's public GitHub repository. Taiko halted block production and froze withdrawals within hours of the theft.
The key, an RSA-3072 private key (enclave-key.pem) for Taiko's Intel SGX prover Raiko, was committed to the open-source taikoxyz/raiko repository and publicly accessible, CryptoTimes reported. Such a key is designed to remain sealed inside secure hardware; its exposure let the attacker enroll as a legitimate network prover. Once registered, the attacker signed fraudulent withdrawal proofs and submitted them to Taiko's Ethereum-side verifier, which accepted the forged attestations. Real assets left the bridge without any matching deposits on Taiko's chain.
Security firm BlockSec identified the exposed key as the root cause, according to CoinDesk. Quill Audits, which analyzed the attack separately, described it as a two-stage operation: the attacker "forged SGX prover registrations, generated fake L2 state attestations, and drained Taiko's L1 Bridge and ERC20Vault," per CryptoTimes.
The two affected contracts, L1 Bridge (0xd60247c6848B7Ca29eDdF63AA924E53dB6Ddd8EC) and ERC20Vault (0x996282cA11E5DEb6B5D122CC3B9A1FcAAD4415Ab), were paused once the team identified the breach. On-chain data cited by Metaverse Post shows the attacker transferred roughly 1.99 million TAIKO tokens, worth approximately $189,000, to MEXC exchange and retained about 870.8 ETH, worth approximately $1.52 million.
Taiko contained the incident by approximately 2:08 a.m. ET and activated its Security Council, Thirdweb reported. The team urged users to withdraw from all network bridges and asked exchanges to suspend TAIKO deposits. As of June 23, no recovery plan or compensation fund has been announced.
The TAIKO token fell more than 20% from midnight UTC on June 22, per CoinDesk.
