What happened
On June 21, 2026, Taiko’s proving path accepted forged state that enabled approximately $1.7M in bridge and ERC20-vault withdrawals. Taiko later recollateralized the bridge and said affected users were made whole.
An exposed signing key and an attestation check that failed to reject a prover running in debug mode allowed forged proofs to pass; the permissionless proving fallback then enabled withdrawals from the fake state.
How it happened
The attacker registered rogue debug-mode provers, submitted forged proofs, made a fake L2 state appear finalized on Ethereum, and used that state to withdraw bridge and vault assets.
Protocol details
Funds Recovery
Recovered
$1.7M
Net Loss
$0
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
