Taiko has warned users to withdraw funds from all bridges due to a breach in its verification system, with losses estimated over $1.7 million.
Summary
- Taiko urges immediate withdrawal of funds from all bridges following a compromise of its chain state verification system.
- BlockSec Phalcon estimates losses exceeding $1.7 million, attributed to a leaked Raiko SGX enclave signing key.
- The incident raises significant concerns about the integrity of the protocol's proof verification processes.
Taiko has issued a warning to users to withdraw their funds from all bridges linked to its Ethereum layer-2 solution due to a serious security compromise in its chain state verification mechanism.
In a statement released on Sunday, Taiko developers expressed that the security protocols supporting the bridges can no longer be considered reliable. They are collaborating with their Security Council and ecosystem partners to manage the breach, suspend affected systems where possible, and investigate both technical and legal remedies.
"We strongly advise all users to withdraw their funds from all bridges deployed on Taiko immediately," the team emphasized on X.
Taiko is built on Ethereum and employs zero-knowledge rollups to improve transaction efficiency while maintaining compatibility with Ethereum. Co-founded by Daniel Wang, a former CEO of Loopring, the network's mainnet was launched in May 2024 to enhance Ethereum's scalability.
While Taiko has not disclosed the specific details regarding the breach or the total losses incurred, BlockSec Phalcon, a blockchain security firm, has reported that the attack resulted in losses exceeding $1.7 million. Their initial analysis indicates that the breach was linked to a Raiko SGX enclave signing key that was publicly accessible on GitHub.
BlockSec noted, "The accessibility of the enclave signing key may have compromised the SGX prover trust model," suggesting that this exposed key allowed attackers to register SGX instances under their control.
According to BlockSec's findings, the attackers likely exploited compromised verifier instances to generate fraudulent proofs accepted by Taiko's verification contracts, leading to the unauthorized release of Ethereum-based assets from the ERC20Vault.
This incident at Taiko is one of several significant breaches in the crypto space. Earlier this year, KelpDAO's cross-chain bridge lost $292 million, reportedly linked to North Korea's Lazarus Group. Other breaches include an incident involving Echo Protocol, which reported unauthorized minting losses of $77 million, later revised to $816,000, and Raydium's loss of $1.34 million due to outdated liquidity pools.
Overall, decentralized finance (DeFi) protocols have suffered losses exceeding $840 million in the first half of this year.
