Taiko, the first based rollup on Ethereum, faced a serious security incident on June 22, 2026. Attackers successfully exploited a vulnerability in the project’s chain state verification mechanism, which allowed them to drain funds from Taiko’s ERC20 Vault deployed on Ethereum mainnet.Taiko has officially confirmed the security breach after detecting the compromise. The project quickly issued an urgent security notice to alert the community.
⚠️ Security Notice
1/2: We have confirmed a compromise of Taiko’s chain state verification mechanism. As a result, the security assumptions of all bridges deployed on Taiko can no longer be relied upon.
We are actively coordinating with the Security Council and ecosystem…
— Taiko.eth 🥁 (@taikoxyz) June 22, 2026
The project also requested centralized exchanges to suspend TAIKO deposits until further notice. The official announcement was made around 00:44 – 00:49 UTC on June 22, 2026. Blockchain security firm Blockaid first flagged suspicious activity on the ERC20 Vault contract. Attackers submitted forged message proofs that the Ethereum mainnet accepted without any corresponding valid MessageSent events originating from the Taiko chain. This enabled unauthorized registration of bridge messages and the subsequent release of assets.
The incident comes only days after the Aztec Private Rollup Bridge was hit by another $2.2 million exploit, adding to mounting concerns over the security of cross-chain bridge infrastructure.
Preliminary on-chain analysis places losses at around $1.7 million, primarily in USDC and ETH. The attacker also transferred nearly 2 million TAIKO tokens toward exchanges such as MEXC. Some tokens were reportedly frozen following rapid coordination between Taiko and exchange partners.
Attacker addresses shared by Taiko:
- 0x7506DeA0c38ca0B55364B22424374c5A1ae1B76a
- 0x5fbc60a12bc6635e7d587d8dac52e4b1388b4990
- 0x3cc936b795a188f0e246cbb2d74c5bd190aecf18
- 0x9108828e30f2de407aadb0af677b4a9228e4acd4
Taiko responded swiftly by halting block production, activating its Security Council, and working with ecosystem partners on containment, technical fixes, and legal measures. The team indicated that additional updates would follow as the investigation progresses.
As of June 22, 2026, ~05:00 UTC, the TAIKO token is trading at approximately $0.079 – $0.082 USD. According to CoinMarketCap, the current market capitalization is $15.32 million, with a +4.71% increase in the last 24 hours and significantly elevated trading volume. The exploit size of $1.7 million is relatively small compared to the project’s market cap, and Taiko’s quick response appears to have limited immediate panic selling so far. However, prolonged negative sentiment could exert downward pressure in the coming days.
As a based rollup, Taiko relies on Ethereum L1 validators for sequencing rather than a centralized sequencer. It has employed a multi-prover system, including Intel SGX instances for faster verification during its transition toward full zero-knowledge proofs. The exploited vector appears tied to the permissionless aspects of proof registration and verification in the bridge infrastructure.
The latest breach also follows the recent $11.58 million exploit of the Verus Ethereum Bridge, underscoring how bridge verification systems continue to be among the most attractive targets for sophisticated attackers.
This incident adds to a string of bridge-related exploits in 2026, a category that has seen hundreds of millions in cumulative losses across various protocols. Bridges remain a persistent high-value target due to their role in cross-chain asset movement and the complexity of verification mechanisms spanning multiple networks.
What Users Should Do
Users with assets bridged on Taiko should prioritize immediate withdrawals using only official Taiko interfaces and monitor official channels (@taikoxyz) for further guidance on resumption.The project has committed to strengthening controls around prover registration and verification processes.
