Taiko: Attack due to chain-off signing key leak and verification process oversight

Odaily Odaily reports that Ethereum Layer 2 network Taiko released a post-mortem of the June 21 security incident, stating that the attack resulted from a leaked off-chain signing key and a verification process oversight. The attacker used these to forge proofs and bypass the Prover whitelist, rather than exploiting ZK cryptography or smart contract vulnerabilities. The attacker stole approximately $1.75 million from cross-chain bridges and Vaults, but over $11 million in assets were protected, and no user funds were lost. Taiko has patched the vulnerability, restored the state to before the attack, and resumed operations on July 2; OpenZeppelin's audit confirmed that the fix has no high, medium, or low severity vulnerabilities. The official also stated that the Unzen upgrade, scheduled for August 6, will require a ZK proof for each block to further enhance network security.