Taiko has suspended its Ethereum layer-2 network after a $1.7 million exploit, urging users to withdraw their funds amid a drop in token value.
Swift action by Taiko minimizes impact of a significant security breach
Taiko, an Ethereum layer-2 platform, has suspended its block production and instructed users to withdraw their funds due to an exploit that resulted in the theft of approximately $1.7 million.
The incident involved an attacker who manipulated withdrawal proofs, allowing them to submit withdrawal requests on Ethereum without corresponding deposits on Taiko. This breach led to the draining of funds from the bridge and the token vault before Taiko's team was able to intervene.
Since the exploit was detected, the TAIKO token has dropped over 20%, reflecting the incident's impact on investor confidence. The token's total valuation stands at around $14.5 million.
According to Taiko, the attacker forged proofs necessary for validating withdrawals, indicating a possible compromise of a critical signing key. Security firm BlockSec noted that this vulnerability arose from a Raiko signing key inadvertently exposed on GitHub, which should have remained secure to maintain the integrity of transaction proofs.
"Our initial investigation suggests the likely root cause was an exposed Raiko SGX enclave signing key on GitHub," stated BlockSec in a recent update.
In response to the breach, Taiko has advised users to withdraw from all bridges on its network and has requested exchanges to halt TAIKO token deposits. The network's block producers have also been instructed to cease block creation while an investigation is ongoing.
By early morning, Taiko confirmed that the exploit had been contained and that further withdrawals through its primary bridge and token vault had been halted. The attacker had already moved around 2 million TAIKO, valued at about $170,000, to an account on the MEXC exchange.
Despite the relatively modest financial loss, the exploit highlights vulnerabilities in cross-chain bridges, which have seen over $340 million in losses due to similar attacks this year. Taiko's prompt response helped limit the fallout from this incident, which echoes previous significant breaches within the decentralized finance (DeFi) sector.
Taiko, which launched on Ethereum in May 2024, is currently preparing a comprehensive report on the incident.
