Taiko's $1.7M Bridge Hack Traced to a Leaked SGX Key on GitHub

A single signing key left publicly accessible on GitHub let an attacker forge withdrawal proofs and drain $1.7 million from Taiko's bridge before the team could halt block production.

Taiko, an Ethereum Layer 2 network that batches transactions off-chain and settles them to Ethereum, stopped producing blocks early Monday after the exploit. The team urged all users to withdraw from every bridge and asked centralized exchanges to suspend TAIKO deposits.

Forged Proofs, Real Ether

The attacker abused Taiko's cross-chain bridge, which uses cryptographic proofs to convince Ethereum that a withdrawal corresponds to a real deposit on Taiko. By forging those proofs, the attacker registered fraudulent withdrawals on Ethereum without any matching transaction on Taiko, draining the bridge and token vault.

Security firm BlockSec traced the root cause to an exposed Raiko SGX enclave signing key. Raiko is Taiko's multi-prover stack that produces the proofs that Ethereum trusts. That key is supposed to remain sealed inside Intel SGX secure hardware, guaranteeing that only legitimate provers can sign. Someone left it on GitHub, publicly readable.

With the key in hand, the attacker could enroll their own provers as legitimate. The verifier on Ethereum accepted the fraudulent proofs, and out went $1.7 million in assets.

Same Flaw, Smaller Damage

The dollar loss is modest compared to the $340 million stolen across at least 14 bridge exploits this year. Forged cross-chain messages drained $292 million from Kelp DAO's bridge in April and $11.4 million from the Verus-Ethereum bridge in May. Taiko's exploit uses the identical mechanism: one chain is tricked into trusting a fake instruction from another.

Taiko caught the outflow and froze the bridge within hours. The exploiter had already moved about 2 million TAIKO (roughly $170,000) to an account on MEXC exchange. But the broader trend is clear: if your cross-chain proof system relies on a single key, that key better not be on GitHub.

Taiko said it will publish a full incident report Monday in Asian hours. Until then, the network stays halted, and every bridge user should assume their funds were at risk the moment that key went public.

Source: Taiko halts its Ethereum layer 2 network after a bridge exploit, token dives 10%
Domain: coindesk.com