Taiko, an Ethereum layer-2 network, halted block production on June 22, 2026 and told users to pull their money out of every bridge after an attacker forged withdrawal proofs and drained roughly $1.7 million from its main bridge and token vault. The team’s Security Council paused the Bridge and ERC20Vault contracts, asked its block producers to stop creating new blocks, and requested that centralized exchanges suspend deposits of the TAIKO token while it traced the breach. The chain’s native token fell more than 20% from its level at midnight UTC, trading near $0.073 in the hours after disclosure.
A layer-2 bridge is the contract that locks assets on Ethereum and releases matching tokens on the layer-2 network, so a forged proof on either side lets an attacker withdraw real funds that were never deposited.
Key takeaways
- An attacker forged cross-chain proofs to drain about $1.7 million from Taiko’s L1 Bridge and ERC20Vault before the team froze the network.
- Security firm BlockSec traced the likely root cause to an Intel SGX signing key for Taiko’s Raiko prover that was committed publicly to the project’s GitHub repository.
- Taiko’s Security Council paused the affected contracts, stopped block production, and confirmed the exploit was contained by roughly 2 a.m. ET, with pending transactions paused rather than lost.
- The TAIKO token, with a market capitalization near $14.5 million, dropped more than 20% from its midnight UTC level.
Published: June 22, 2026, 21:50 UTC
What happened and how the bridge was drained
The attacker did not break Taiko’s cryptography. They got hold of a key that was supposed to stay hidden. Taiko uses a component called Raiko to generate proofs confirming that transactions on the layer-2 are genuine, and those proofs are signed inside Intel SGX secure hardware so Ethereum’s verifier will trust them.
An RSA-3072 private key used for that SGX enclave signing was committed in plain view to the public taikoxyz/raiko repository, according to BlockSec’s initial investigation. With the key in hand, the attacker enrolled their own provers as legitimate, generated fake layer-2 state attestations, and signed fraudulent withdrawal proofs that Taiko’s verifier accepted. The drain happened across two phases before the team intervened.
BlockSec said the flaw is the same category that produced this year’s largest bridge hacks: not a smart-contract bug, but a trust assumption that collapsed once a secret leaked.
Who is affected and what comes next
Bridge users carry the immediate risk. Taiko told everyone holding assets on its bridges to withdraw, and warned against initiating new bridge transactions until the all-clear. The team says pending transactions are paused, not lost, which means funds already in transit should remain recoverable once the network resumes.
For traders, the damage was quick and visible in the token price. For Taiko’s developers, the harder problem is rebuilding trust in the proving system. Restoring the network safely requires rotating the compromised signing infrastructure and auditing what else may have been exposed in the repository.
The incident also reopens a wider debate about SGX-based proving across the layer-2 sector. Several teams lean on trusted hardware to keep proving cheap and fast, and a single leaked key shows how fragile that model becomes when operational security slips. Expect competing layer-2s and auditors to point to this as a reason to move toward proving methods that do not depend on a secret staying sealed.
Frequently asked questions
How much did the Taiko bridge exploit cost?
The attacker drained roughly $1.7 million from Taiko’s L1 Bridge and ERC20Vault. Taiko’s Security Council froze the affected contracts and said the exploit was contained within hours of disclosure on June 22, 2026.
What caused the Taiko exploit?
BlockSec’s early analysis points to an Intel SGX signing key for Taiko’s Raiko prover that was publicly committed to GitHub. The exposed key let the attacker register fake provers and sign fraudulent withdrawal proofs the network accepted as valid.
Are Taiko user funds safe now?
Taiko says the exploit is contained and pending transactions are paused rather than lost. The team still urged users to withdraw from its bridges and to avoid new bridge transactions until it confirms the network is safe to use again.
