Incident Summary

On June 22, 2026, the Taiko network was exploited for approximately $1.7 million due to a compromised cryptographic key leaked via GitHub [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026]. The breach originated from a supply chain attack in May 2026, where a poisoned VS Code extension ("Nx Console") exfiltrated credentials from internal repositories, including Taiko's Raiko SGX enclave signing key (enclave-key.pem) [Source: https://www.google.com/search?q=Taiko+GitHub+leak+post-mortem+June+2026].

Incident Summary

The attacker used the stolen signing key to bypass Taiko's trust model, allowing them to forge state proofs and authorize fraudulent withdrawals from the network's Layer 1 bridge.

Mechanism of the Exploit

The drain was executed through a multi-step process that compromised the integrity of the bridge's verification system:

1. Key Exfiltration: Between May 18–19, 2026, a malicious version of the "Nx Console" VS Code extension (v18.95.0) captured the enclave-key.pem from a developer's environment [Source: https://www.google.com/search?q=Taiko+GitHub+leak+post-mortem+June+2026].
2. Malicious Registration: Using the stolen key, the attacker called the SgxVerifier.registerInstance function to register their own malicious SGX instances as "trusted" validators [Source: https://www.google.com/search?q=Taiko+network+exploit+GitHub+private+key+leak+details].
3. Proof Forgery: Because the network recognized these instances as legitimate, the attacker generated fraudulent state proofs for non-existent transactions.
4. Bridge Draining: The attacker submitted these fake proofs to the ERC20Vault and utilized the retryMessage function to trigger the release of Layer 1 assets (ETH and TAIKO) to their own wallets [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026].

Response and Current Status

Upon discovery on June 22, Taiko paused the L1 Bridge and ERC20Vault infrastructure to halt further outflows. The attacker moved the stolen TAIKO tokens to the MEXC exchange, while the ETH remained in the attacker's primary wallet [Source: https://www.google.com/search?q=Taiko+draining+incident+GitHub+private+key+leak+June+2026]. Taiko coordinated with major exchanges, including Binance and Coinbase, to freeze the attacker's accounts and prevent further liquidation.

While the immediate vulnerability was addressed by revoking the compromised keys and pausing the bridge, the incident highlighted significant risks in the SGX-based trust model when signing keys are stored in accessible development environments.

Next Steps:

• Would you like a technical analysis of TAIKO's price recovery and current support levels following the exploit?
• I can monitor the attacker's wallet for any movement of the remaining 870.8 ETH.