Incident Overview

On June 22, 2024, the Taiko network lost approximately $1.7 million due to an operational security failure where an RSA-3072 private key (enclave-key.pem) was accidentally committed to the public GitHub repository taikoxyz/raiko [Source: https://example.com/taiko-incident-summary]. This key was used to sign Intel SGX (Software Guard Extensions) enclave proofs, a core component of Taiko's multi-prover bridge architecture. By obtaining this key, an attacker was able to forge attestations that bypassed the bridge's verification logic.

Incident Overview

The Mechanism of the Exploit

The exploit was not a result of a smart contract bug but a compromise of the protocol's Trust Model. Because the private key for the SGX enclave was publicly available, the attacker could generate valid signatures for malicious proofs [Source: https://example.com/taiko-incident-summary].

1. Bypassing MrSigner: Taiko’s L1 contracts verify SGX enclaves using a MrSigner value, which is a hash of the public key. With the leaked private key, the attacker signed proofs that appeared to originate from a legitimate, whitelisted enclave [Source: https://example.com/taiko-bridge-exploit].
2. Two-Phase Execution:
   • Phase 1: The attacker used forged attestations to call processMessage(), which set the status of malicious withdrawal messages to RETRIABLE.
   • Phase 2: The attacker then called retryMessage(). This function had fewer validation checks than the initial processing logic, allowing the attacker to successfully drain funds from the Ethereum mainnet bridge and vault [Source: https://example.com/taiko-bridge-exploit].

Impact and Recovery

Following the detection of the exploit, the Taiko Security Council paused the Bridge and ERC20Vault contracts and temporarily halted block production to prevent further losses [Source: https://example.com/taiko-incident-summary].

• Asset Tracking: Approximately 2 million TAIKO tokens were moved to the MEXC exchange, while the attacker retained roughly 870.8 ETH (valued at ~$1.52 million at the time) in a private wallet [Source: https://example.com/taiko-bridge-exploit].
• Market Reaction: The $TAIKO token price experienced a sharp decline of approximately 10-20% immediately following the news, trading down to roughly $0.07 [Source: https://example.com/taiko-incident-summary].

While Taiko had undergone three separate audits by OpenZeppelin, those reviews focused on code logic and did not cover operational security practices such as secret management within GitHub repositories [Source: https://example.com/taiko-incident-summary].

Unresolved Details

While the root cause is confirmed, a precise second-by-second timeline of the attack phases and the exact block numbers for the forged attestations remain missing from public summaries. Additionally, there is a minor date discrepancy in some reports (listing 2026 vs 2024), though the consensus points to June 2024.

Next Steps

• Would you like a technical deep dive into the current security status of the Taiko bridge contracts?
• I can monitor the attacker's wallet address for any movement of the stolen 870.8 ETH.