Taiko said a critical failure in its chain state verification system led to the loss of roughly $1.7 million from an ERC20 Vault on Ethereum on June 22, 2026. The stolen assets included 650,000 USDC and 130 ETH. After confirming the incident, the project halted block production and warned that the security assumptions behind every bridge deployed on the network should be treated as unreliable for now.
Forged bridge proof was accepted without a matching on-chain event
Preliminary findings from blockchain security firm Blockaid point to a flaw in source-signal proof verification used by the cross-chain bridge. Attackers created a forged message proof that Ethereum mainnet accepted even though no corresponding MessageSent event had ever occurred on Taiko. That gap mattered. It let the attacker register a fake cross-chain message and unlock real assets held inside the ERC20 Vault.
Permissionless prover registration opened the way in
The report says the exploit abused Taiko’s permissionless prover registration design, which allows anyone to register as a prover, including SGX (Secure Enclave) instances. A malicious SGX instance was registered, invalid proofs were submitted, and the system accepted them. Funds were then drained across USDC, ETH, and TAIKO.
Taiko published four confirmed attacker wallets: 0x7506DeA0c38ca0B55364B22424374c5A1ae1B76a, 0x5fbc60a12bc6635e7d587d8dac52e4b1388b4990, 0x3cc936b795a188f0e246cbb2d74c5bd190aecf18, and 0x9108828e30f2de407aadb0af677b4a9228e4acd4. Those addresses have been flagged for blacklisting, and centralized exchanges were urgently asked to suspend TAIKO deposits until official clearance is issued.
TAIKO drops over 16% as users are told to exit bridges
Following the hack, TAIKO fell more than 16% over 24 hours to about $0.079, while trading volume climbed above $30 million. The team’s guidance was direct: users holding assets on any Taiko bridge should withdraw them immediately rather than wait for another update. Taiko also said users should watch for official confirmation that bridge systems have been patched and re-verified before moving funds back.
The incident was not described as an isolated contract failure. It affected every bridge deployed on the network. Attention is now on when bridge operations will be cleared for reopening and whether SGX-based prover systems across other Layer 2 networks will face closer security review after this attack.