Taiko (TAIKO)

I was awake last night when $TAIKO got hacked.

So I made some profits😁🎉 https://t.co/gIqm4TRsQH

🚨Taiko drained for ~$1.7M. Root cause: a private key committed to a public GitHub repo.

enclave-key.pem, the RSA key used to sign all of Taiko's SGX enclaves, sat in the public taikoxyz/raiko repo. That key is the whole trust model.

The attacker derived MrSigner from the public key, signed their own malicious enclave with the leaked key, and registered as a trusted prover. The L1 contracts trust any enclave whose MrSigner matches. It matched.

From there: forged SGX attestations on fake L2 blocks, processMessage() sets the message to RETRIABLE, retryMessage() does zero proof verification, funds leave.

No key theft. No social engineering. No SGX exploit. Just a .pem in a public repo.

Good opportunity to recall that SGX is broken. But here, nobody even had to break it.

It's just yet another key management failure. The whole system was only ever as strong as the secrecy of one RSA key, and that secrecy depended on a human not running git add . on the wrong folder. AI greps every commit of every public repo

@taikoxyz #PeckShieldAlert @taikoxyz exploiter has deposited 180 $ETH (~$300K) into #TornadoCash https://t.co/d7UEUm2PB6