Taiko's L2 bridge went dark early Sunday after an attacker used a signing key that had been left publicly exposed in the protocol's GitHub repository to forge withdrawal proofs and drain roughly $1.7 million from bridge contracts on Ethereum mainnet.
The team urged all users to exit every bridge deployed on Taiko immediately after activating its Security Council multisig to pause withdrawals and halt block production. The incident occurred early in the morning on June 22, according to Blockaid, the onchain security firm that detected the attack in real time. PeckShield later estimated losses at approximately $1.7 million, with the attacker moving around 1.99 million TAIKO tokens to the MEXC exchange before the freeze landed.
The root cause was operational. An RSA-3072 private key for Raiko, Taiko's multi-prover stack, had been committed as a file called `enclave-key.pem` to the public `taikoxyz/raiko` repository on GitHub. Raiko uses Intel SGX enclaves to generate cryptographic attestations that Taiko's L1 bridge contracts accept as proof that L2 state transitions are valid. With the key publicly accessible, the attacker enrolled their own SGX prover and signed fraudulent L2 state attestations that the on-chain verifier treated as legitimate.
