Taiko exploit analysis

The Taiko bridge between Ethereum mainnet and the Taiko layer-2 chain was exploited for at least $1.7 million on June 22, 2026, before the protocol team halted block production and disabled the affected contracts. The attack relied on the bridge contract accepting forged source-signal proofs as valid. Blockonomi reported the technical detail; crypto security firm BlockSec observed that the attacker may have gained access to a signing key that had been exposed on GitHub.

What the forged proofs unlocked

The bridge contract's role is to verify, on Ethereum's base layer, that a corresponding transaction has actually happened on Taiko. The validation path that the attacker exploited did not sufficiently check the contents of those proofs, allowing the attacker to submit bridge messages that unlocked assets from the ERC-20 vault for which no real Taiko-side deposit existed. Nearly 2 million Taiko tokens were transferred by the attacker to MEXC. Approximately $1.5 million in stolen funds, predominantly Ether, remained in attacker-controlled addresses at the time of the report.

Response

Taiko urged users to withdraw from bridge contracts, suspended block production and disabled compromised infrastructure. The protocol reopened the bridge on July 2 after a fix, with the team stating affected users were made whole.

Where it sits in the corpus

The signing-key hypothesis puts Taiko alongside Gravity Bridge, where a compromised validator key was the working explanation for a $5.4 million drain three weeks earlier, and Humanity Protocol, where malware on a single laptop yielded the multisig threshold for a $36 million bridge exploit a few weeks later. Three high-profile 2026 losses; in each case the smart contracts behaved as designed and the failure was on the operator side.