How the Attack Was Executed

The root cause of the exploit was an RSA private key — the Raiko SGX enclave signing key — that was inadvertently exposed on GitHub . This key, used by the Raiko prover to cryptographically sign attestations of correct block verification, had been publicly committed to the taikoxyz/raiko repository for roughly two years . An attacker used the leaked key to register rogue provers and forge withdrawal proofs on Taiko's cross-chain bridge . Specifically, they crafted a forged message proof that was accepted on Ethereum L1 without a legitimate event being generated on the source chain, allowing them to drain assets from the ERC-20 Vault . The exploit was first detected by security firm BlockSec, which identified the exposed Raiko signing key on GitHub as the root cause . The stolen assets were primarily in USDC and ETH .

The Four-Step Restart Plan

After independent security reviews confirmed the attack path was closed, Taiko outlined a phased restart :

Step 1 — Restore chain activity. Bring the Taiko L2 network back online and resume normal block production after deploying the security patch .

Step 2 — Ensure bridge assets are fully backed 1:1. Before the bridge reopens, the team will fully replenish all undercollateralized bridged assets, making user balances 100% backed .

Step 3 — Reopen L2 activity fully. Allow normal L2 transactions to resume with the patched infrastructure .

Step 4 — Unpause bridge withdrawals under conservative quotas. Withdrawals from the bridge will be reintroduced gradually with quotas to maintain safety during the initial period .

User Fund Protection and Collateral Replenishment

Taiko explicitly stated that "this incident will not result in any loss of user funds" . The exploit left the bridge temporarily undercollateralized. Taiko committed to fully replenishing the missing collateral before reopening the bridge, ensuring all user balances are 1:1 backed . The team is collaborating with the Taiko DAO Council and Security Council to coordinate the recovery . A formal report was also submitted to Singaporean authorities as part of the cooperative process .

Legal Actions and Phishing Scam Precautions

Taiko is working closely with its Security Council and ecosystem partners on the investigation and has coordinated with centralized exchanges to block TAIKO deposits as a precaution . The team urged users to immediately withdraw funds from all bridges deployed on the Taiko network and warned that the security assumptions behind those bridges could no longer be relied upon during the incident . Taiko has also publicly warned the community to be vigilant against phishing scams and impersonation attempts that often follow major exploits, advising users to only trust communications from Taiko's official social media channels . The project is pursuing legal and investigative avenues with law enforcement and security partners to track and potentially recover the stolen funds, though specific case details have not been publicly disclosed .

How the Attack Was Executed

The root cause of the exploit was an RSA private key — the Raiko SGX enclave signing key — that was inadvertently exposed on GitHub . This key, used by the Raiko prover to cryptographically sign attestations of correct block verification, had been publicly committed to the taikoxyz/raiko repository for roughly two years . An attacker used the leaked key to register rogue provers and forge withdrawal proofs on Taiko's cross-chain bridge . Specifically, they crafted a forged message proof that was accepted on Ethereum L1 without a legitimate event being generated on the source chain, allowing them to drain assets from the ERC-20 Vault . The exploit was first detected by security firm BlockSec, which identified the exposed Raiko signing key on GitHub as the root cause . The stolen assets were primarily in USDC and ETH .

The Four-Step Restart Plan

After independent security reviews confirmed the attack path was closed, Taiko outlined a phased restart :

Step 1 — Restore chain activity. Bring the Taiko L2 network back online and resume normal block production after deploying the security patch .

Step 2 — Ensure bridge assets are fully backed 1:1. Before the bridge reopens, the team will fully replenish all undercollateralized bridged assets, making user balances 100% backed .

Step 3 — Reopen L2 activity fully. Allow normal L2 transactions to resume with the patched infrastructure .

Step 4 — Unpause bridge withdrawals under conservative quotas. Withdrawals from the bridge will be reintroduced gradually with quotas to maintain safety during the initial period .

User Fund Protection and Collateral Replenishment

Taiko explicitly stated that "this incident will not result in any loss of user funds" . The exploit left the bridge temporarily undercollateralized. Taiko committed to fully replenishing the missing collateral before reopening the bridge, ensuring all user balances are 1:1 backed . The team is collaborating with the Taiko DAO Council and Security Council to coordinate the recovery . A formal report was also submitted to Singaporean authorities as part of the cooperative process .

Legal Actions and Phishing Scam Precautions

Taiko is working closely with its Security Council and ecosystem partners on the investigation and has coordinated with centralized exchanges to block TAIKO deposits as a precaution . The team urged users to immediately withdraw funds from all bridges deployed on the Taiko network and warned that the security assumptions behind those bridges could no longer be relied upon during the incident . Taiko has also publicly warned the community to be vigilant against phishing scams and impersonation attempts that often follow major exploits, advising users to only trust communications from Taiko's official social media channels . The project is pursuing legal and investigative avenues with law enforcement and security partners to track and potentially recover the stolen funds, though specific case details have not been publicly disclosed .