Vulnerability in L2 Network Taiko: Hacker Withdraws $1.7 Million Through Compromised Verification Mechanism
On June 22, the team behind the second-layer solution Taiko confirmed a critical security incident. An attacker compromised the blockchain state verification mechanism, jeopardizing all bridges deployed on the network. Developers stated that the security of bridge protocols can no longer be relied upon and strongly recommended that users immediately withdraw their funds.
According to the analytical platform Lookonchain, the damage amounted to approximately $1.7 million. The hacker stole native TAIKO tokens and various "wrapped" ETH. Part of the stolen funds—about 1.99 million TAIKO ($189,000)—has already been deposited on the MEXC exchange. At the time of publication, the attacker still held 870.8 ETH, worth around $1.52 million.
The project is coordinating actions with the security council and ecosystem partners to localize the attack. The team has also asked centralized exchanges to suspend TAIKO deposits until further official notice. Amid the incident, the TAIKO coin dropped 11% in a day—from $0.09 to $0.07—as confirmed by the 15-minute chart of the TAIKO/USDT pair on the HTX exchange.
This incident echoes the recent hack of the Axelar bridge with Secret Network, where on June 19 an attacker withdrew about $4.67 million using an "infinite mint" vulnerability. Both cases highlight systemic risks associated with the security of cross-chain bridges in the L2 ecosystem.
Expert opinion: The compromise of the state verification mechanism is not just a local vulnerability but a blow to the fundamental security principles of L2 solutions. Taiko, as a zk-rollup, was supposed to ensure reliable data verification, but this incident shows that even advanced technologies are not immune to implementation errors. The market reacts swiftly: the 11% drop in TAIKO is just the beginning if the team does not provide a transparent remediation plan and restore user trust.