Toko Token (TKO)

Taiko got exploited for around $1.7M.

The attacker forged cross-chain messages and tricked the bridge into processing withdrawals that were never backed by real deposits.

The attacker reportedly walked away with nearly 2M $TKO.

The details are more interesting than the number.

> This wasn't a private key leak or multisig compromise.

> The attacker exploited the bridge's verification logic.

> Fake cross-chain messages were accepted as valid.

> This enabled withdrawals from the ERC20 Vault without legitimate deposits.

What makes this more scary is how it was carried out.

The attacker didn't break Taiko's core tech or even the network.

They carried it out through an approved bridge.

And that's the problem with bridges.

Everything depends on their ability to verify events across chains.

The moment that process fails, assets can be unlocked, minted, or withdrawn without the activity ever taking place.

That's what makes incidents like this so concerning.

The $1.7M loss isn't the scariest part.

The p

⚠️ Security Notice

1/2: We have confirmed a compromise of Taiko’s chain state verification mechanism. As a result, the security assumptions of all bridges deployed on Taiko can no longer be relied upon.

We are actively coordinating with the Security Council and ecosystem partners to contain the incident, pause affected systems where possible, and take all necessary technical and legal actions.

We strongly advise all users to withdraw their funds from all bridges deployed on Taiko immediately.

Further updates will be provided as more information becomes available.