Overview
- Taiko confirmed late Monday that its chain-state verification mechanism was compromised and urged all users to immediately withdraw funds from every bridge on the network.
- Security monitors and Taiko said attackers submitted forged message proofs that passed validation on Ethereum L1 without any matching MessageSent events on Taiko, allowing unauthorized withdrawals from the ERC20 vault.
- Forensic estimates of the loss range from roughly $1 million to $1.7 million, with analytics showing the exploiter moved about 1.99 million TAIKO to the MEXC exchange and roughly $1.5 million in mainly ETH still in attacker wallets.
- Taiko stopped block production, paused affected systems, asked exchanges to suspend TAIKO deposits, and is coordinating with its Security Council while preparing a full incident report and possible technical and legal steps.
- The incident illustrates a recurring systemic risk: exposed signing keys or weak proof-validation can let attackers forge cross-chain messages, a flaw that has driven hundreds of millions in bridge losses this year and could further erode user trust in L2 bridge designs.