Overview
- Taiko confirmed on Monday that its chain‑state verification mechanism was compromised and told all users to withdraw funds from every bridge while it paused block production and blocked further deposits of TAIKO.
- Security firms first flagged crafted message proofs that were accepted on Ethereum without matching MessageSent events on Taiko, letting an attacker register fake bridge messages and trigger vault withdrawals.
- On‑chain analysis revised initial loss estimates up to about $1.7 million, showing 1.99 million TAIKO sent to the MEXC exchange and roughly $1.5 million of stolen assets, mostly ETH, still in exploiter wallets.
- Early forensic work from multiple teams pointed to a likely enabling factor: a Raiko SGX enclave signing key that was reportedly exposed on GitHub and could allow fraudulent provers to sign counterfeit proofs.
- Taiko and its Security Council have contained further outflows, asked exchanges to suspend TAIKO deposits, and said a formal post‑mortem and legal and technical responses are in progress.