Taiko Bridge 2026 message-proof exploit
A compromise of Taiko's chain-state and bridge message-proof verification allowed forged messages to be accepted on Ethereum L1 and enabled fraudulent bridge withdrawals. Taiko estimated approximately USD 1.7 million lost before containment, restored one-to-one backing, reopened the bridge, and stated that all affected users were made whole.
Incident facts
- Incident title
- Taiko Bridge 2026 message-proof exploit
- Bridge
- Taiko Bridge
- Incident date
- 2026-06-21
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Ethereum, Taiko
- Affected assets
- Unknown
- Attack category
- Message Verification Failure
- Reported loss
- Approximately USD 1.7 million
- Recovery
- None
- Reimbursement
- Completed
- Restart
- Reopened
- Current outcome
- Active After Incident
- Resolution
- Final outcome known
- Last reviewed
- 2026-07-28
- Last verified
- 2026-07-28
Timeline events
Taiko recollateralized bridge and reviewed fixes2026-06
Taiko closed the attack path, reviewed fixes with independent specialists, and restored one-to-one backing before reopening.
Forged Taiko bridge messages accepted on Ethereum2026-06-21
Compromised verification allowed fraudulent messages without legitimate source-chain events to release assets through the first-party bridge path.
Taiko halted network and bridge operations2026-06-22
Taiko halted block production and stopped first-party bridge and ERC20Vault withdrawals during containment.
Bridge withdrawals suspended2026-06-22
Taiko warned that bridge withdrawals were not secure during containment and suspended the affected first-party paths.
Taiko estimated losses before containment2026-06-22
Taiko estimated approximately USD 1.7 million in losses before the pause stopped further fraudulent withdrawals.
Taiko Bridge reopened2026-07-02
Taiko stated that the network and bridge were restored and the bridge was open with conservative withdrawal quotas.
Taiko stated all affected users were made whole2026-07-02
The first-party reopening statement said every affected user had been made whole.
Conservative withdrawal quotas retained2026-07-02
Taiko retained temporary withdrawal quotas as a post-reopening safeguard.
Evidence records
- Taiko incident and containment statementTaiko · Tier 1 · 2026-06-22
- Taiko bridge reopening and make-whole statementTaiko · Tier 1 · 2026-07-02
- Taiko confirms exploit and halts block productionThe Block · Tier 2 · 2026-06-22
- Taiko reopens bridge after USD 1.7M exploitCrypto Economy · Tier 3 · 2026-07-02
Known unknowns
- A final public asset-by-asset loss table was not located.
- The reviewed sources do not establish attacker-fund recovery.
- The narrow relationship among signing material, prover enrollment, source-signal validation, and final message-proof acceptance remains subject to a future postmortem review.