Taiko says June security incident stemmed from offchain signing key leak and verification gap

Ethereum Layer 2 network Taiko has released its post-incident review of the June 21 security event, saying the attack began offchain rather than through a failure in zero-knowledge cryptography. According to the team, the attacker used a leaked signing key together with a missed validation check to forge proofs and bypass the protocol’s prover whitelist. Taiko said its zk-proof encryption was not affected. The project also detailed the measures that limited the damage. It said the bridge’s daily transfer cap slowed the outflow of funds, while the security council suspended both the bridge and the vault within hours, preventing additional movement of assets. Taiko added that no users suffered losses in the incident. In its accounting of the event, the team said the attacker stole about $1.75 million from the cross-chain bridge and vault, while more than $11 million was protected. Since the network resumed operations, Taiko said all balances on the network have been backed 1:1.