POPA ReconTaiko Drained for $1.7M - Private Key Sat in a Public GitHub Repo
Taiko Drained for $1.7M - Private Key Sat in a Public GitHub Repo Ethereum L2 Taiko was exploited for $1.7M on June 22, and the cause is almost too simple to believe - an RSA private key used to sign all of Taiko's SGX enclaves was committed to the public taikoxyz/raiko GitHub repo. Taiko's L1 contracts trusted any enclave matching the stored MrSigner value, so with the leaked key, the attacker registered a malicious prover, forged fake L2 attestations, and drained the L1 Bridge and ERC20Vault across two phases. No key theft, no social engineering, no SGX exploit - just a .pem in a public…
The excerpt is quoted from a public Telegram channel, which owns its text.