Taiko Halts Withdrawals After $1.7M Bridge Exploit

On June 22, Taiko, an Ethereum layer-2 scaling protocol, halted withdrawals after attackers exploited a flaw in its bridge proof validation and withdrew about $1.7 million from the protocol’s ERC-20 vault.

The weakness affected the chain state verification used by bridges on Taiko. Attackers submitted crafted message proofs that the system accepted as valid on Ethereum layer 1, which bypassed normal validation and triggered unauthorized withdrawals from the ERC-20 vault.

Taiko detected the breach on June 22 and moved to contain the incident by pausing affected systems and stopping withdrawals through the bridge and the ERC-20 vault. The project wrote: “We are actively coordinating with the Security Council and ecosystem partners to contain the incident, pause affected systems where possible, and take all necessary technical and legal action. We strongly advise all users to withdraw their funds from all bridges deployed on Taiko immediately.” In a later update Taiko added that it had fully stopped withdrawals and that users no longer needed to take action, while still requesting that centralized exchanges suspend TAIKO deposits.

Blockchain security firms attributed the loss to a flaw in Taiko’s bridge source-signal proof validation rather than a compromise of private keys or external services. According to their analysis, crafted proofs were mistakenly accepted as valid on Ethereum mainnet, allowing the attackers to initiate the unauthorized transfers.

Market data showed the protocol’s native token, TAIKO, briefly rose to about $0.097 before falling to roughly $0.075, a decline of about 10% from earlier levels. Some observers reported a sharper, brief spike before the token moved lower.

Taiko said it is working with security partners and ecosystem participants to identify those responsible and assess the full impact. The team indicated it will pursue technical and legal steps as needed while withdrawals remain halted and operational controls stay in place.