Back
Taiko urges bridge withdrawals after compromise tied to about $1.7 million loss

Taiko urges bridge withdrawals after compromise tied to about $1.7 million loss

Taiko later estimated losses at roughly $2.2 million, said affected users are expected to be reimbursed from the protocol treasury, and is tightening proof and signal controls as recovery work continues.

ETH
USDC

Fact Check
All components of the claim are corroborated by primary and credible sources. The Blockaid X post (originating detection source) confirms an ongoing exploit of Taiko's ERC20 Vault on Ethereum at ~$1M+. BlockBeats and Odaily independently describe the proof verification / source-signal flaw that allowed forged bridge message proofs to be accepted on Ethereum without a legitimate MessageSent event. Taiko's official X account confirmed the chain state verification mechanism compromise, invalidating security assumptions for all bridges, pausing affected systems, and urging immediate withdrawals. The PANews report attributes the additional request for centralized exchanges to halt TAIKO deposits to that official announcement. The convergence of the protocol's own statement, the security firm's detection, and multiple news outlets makes the claim highly reliable.
Summary

Taiko urged users to withdraw funds from all Taiko-deployed bridges after saying its chain state verification mechanism was compromised, undermining the security assumptions behind those bridges. The project and security researchers said forged message proofs were accepted on Ethereum L1 without a legitimate source-chain event, allowing fraudulent withdrawals from bridge and token vaults. An Etherscan transaction showed 649,761.236201 USDC moving from the Taiko ERC20 Vault to an exploiter address on June 21 at 22:07:23 UTC, while early estimates put losses at about $1.7 million before later project updates indicated roughly $2.2 million. Taiko said affected users' funds are expected to be reimbursed from the protocol treasury, and its response has included coordinating with its Security Council and ecosystem partners, asking centralized exchanges to suspend TAIKO deposits, and implementing code changes including temporarily disabling permissionless inbox proving and proposing and introducing SignalService checkpoint versioning.

Terms & Concepts
  • chain state verification: The process of confirming that blockchain state data and related proofs are valid before other systems rely on them.
  • message proofs: Cryptographic evidence a bridge uses to verify that an event on one chain really happened before releasing assets on another.
  • SignalService checkpoint versioning: A mechanism for invalidating older bridge verification checkpoints after a version change to prevent unsafe proofs from being reused.