Taiko paused block production on its Ethereum layer-2 network and urged users to withdraw funds after a bridge exploit was identified early Monday. The project estimated losses at roughly $1.7 million before quickly containing the issue, while the TAIKO token—valued at about $14.5 million in market cap—fell more than 20% since the start of the UTC day.

The attacker managed to forge withdrawal proofs used by the bridge to verify that withdrawals correspond to legitimate deposits. This enabled fake withdrawal requests to be accepted on Ethereum without matching transactions on Taiko’s chain, allowing funds to be siphoned from the bridge and token vault, according to the team.

Bridges are cross-chain infrastructure systems that transfer assets between blockchains such as Taiko and Ethereum. Layer-2 networks execute transactions off-chain and later settle them on Ethereum to improve speed and lower costs.

Preliminary investigations suggest the exploit may have originated from a compromised signing key used in the proof-generation process. Security firm BlockSec said a Raiko signing key—used to generate validity proofs—appears to have been exposed publicly on GitHub.

These keys are normally stored in secure hardware environments to ensure they cannot be tampered with. If exposed, attackers can impersonate legitimate provers, generate valid-looking proofs, and trick the system into approving unauthorized withdrawals on Ethereum.

In response, Taiko instructed users to withdraw from all bridges, asked centralized exchanges to suspend TAIKO deposits, and temporarily halted block production while it investigated the incident.

By around 2 a.m. ET, the team said the exploit had been contained and withdrawals via the main bridge and token vault were stopped. The attacker had already moved about 2 million TAIKO—worth roughly $170,000—to an address on the MEXC exchange.

While the direct losses were relatively limited, the incident highlights ongoing vulnerabilities in cross-chain bridge systems, which remain frequent targets for DeFi exploits.

Similar attacks include $292 million drained from Kelp DAO’s bridge in April and $11.4 million stolen from the Verus-Ethereum bridge in May. In total, bridge-related exploits have exceeded $340 million across at least 14 incidents in 2026, underscoring the sector’s continued security challenges. Taiko’s losses were contained largely due to rapid detection and response.