Incident Summary
Published 6/23/2026, 7:52:01 AM
On June 22, 2026, the Taiko network was exploited for approximately $1.7 million due to a compromised cryptographic key leaked via GitHub [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026]. The breach originated from a supply chain attack in May 2026, where a poisoned VS Code extension ("Nx Console") exfiltrated credentials from internal repositories, including Taiko's Raiko SGX enclave signing key (enclave-key.pem) [Source: https://www.google.com/search?q=Taiko+GitHub+leak+post-mortem+June+2026].
Incident Summary
The attacker used the stolen signing key to bypass Taiko's trust model, allowing them to forge state proofs and authorize fraudulent withdrawals from the network's Layer 1 bridge.
| Metric | Details |
|---|---|
| Total Estimated Loss | ~$1.7 million USD |
| Assets Stolen | 870.8 ETH ( |
| Root Cause | Exposed Raiko SGX enclave signing key via GitHub leak |
| Primary Attack Vector | Forged state proofs and malicious SGX instance registration |
| Market Impact | TAIKO price fell ~11% (from $0.09 to $0.07) |
Mechanism of the Exploit
The drain was executed through a multi-step process that compromised the integrity of the bridge's verification system:
- Key Exfiltration: Between May 18–19, 2026, a malicious version of the "Nx Console" VS Code extension (v18.95.0) captured the
enclave-key.pemfrom a developer's environment [Source: https://www.google.com/search?q=Taiko+GitHub+leak+post-mortem+June+2026]. - Malicious Registration: Using the stolen key, the attacker called the
SgxVerifier.registerInstancefunction to register their own malicious SGX instances as "trusted" validators [Source: https://www.google.com/search?q=Taiko+network+exploit+GitHub+private+key+leak+details]. - Proof Forgery: Because the network recognized these instances as legitimate, the attacker generated fraudulent state proofs for non-existent transactions.
- Bridge Draining: The attacker submitted these fake proofs to the ERC20Vault and utilized the
retryMessagefunction to trigger the release of Layer 1 assets (ETH and TAIKO) to their own wallets [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026].
Response and Current Status
Upon discovery on June 22, Taiko paused the L1 Bridge and ERC20Vault infrastructure to halt further outflows. The attacker moved the stolen TAIKO tokens to the MEXC exchange, while the ETH remained in the attacker's primary wallet [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026]. Taiko coordinated with major exchanges, including Binance and Coinbase, to freeze the attacker's accounts and prevent further liquidation.
While the immediate vulnerability was addressed by revoking the compromised keys and pausing the bridge, the incident highlighted significant risks in the SGX-based trust model when signing keys are stored in accessible development environments.
Next Steps:
- Would you like a technical analysis of TAIKO's price recovery and current support levels following the exploit?
- I can monitor the attacker's wallet for any movement of the remaining 870.8 ETH.