Taiko Ethereum Layer 2 Halts Block Production After $1.7 Million Bridge Exploit

Jun 22, 2026

Ethereum Layer 2 network Taiko halted block production after a $1.7 million exploit compromised its chain state verification mechanism. A flaw in proof validation allowed an attacker to create fraudulent bridge messages. Taiko has urged users to withdraw funds from all its bridges and asked exchanges to suspend deposits of its TAIKO token while it investigates with security partners.

Taiko bridge exploit

▪Taiko is an Ethereum-based rollup that launched its mainnet in May 2024 after being in development since 2022.
▪Taiko, an Ethereum Layer 2 network, confirmed a compromise of its chain state verification mechanism.
▪The exploit resulted in the theft of approximately $1.7 million.
▪On-chain security firm Blockaid first identified the exploit, initially reporting losses of around $1 million.

Security response measures

▪Taiko is coordinating with its Security Council and ecosystem partners and may take legal action against the attacker.
▪Taiko advised all users to immediately withdraw their funds from all bridges deployed on the protocol.
▪In response to the exploit, Taiko halted the production of new blocks while its team investigates the issue.
▪The Taiko team requested that centralized exchanges suspend deposits of its native TAIKO token until further notice.

Technical vulnerability details

▪The vulnerability allowed crafted message proofs to be accepted on Ethereum L1 without valid corresponding events on the Taiko chain.
▪A flaw in the Taiko bridge's source-signal proof validation was identified as the root cause of the exploit.
▪This flaw enabled an attacker to register and retrieve fraudulent bridge messages, causing unauthorized asset releases from an ERC20 vault.

Stolen funds tracking

▪The exploiter moved 1.99 million TAIKO tokens to an address on the MEXC crypto exchange.
▪One of the attacker's addresses still holds 870.8 ETH, valued at nearly $1.52 million.
▪Taiko publicly shared four blockchain addresses associated with the attacker to aid in tracking stolen funds.