BlockSec flags possible GitHub-exposed SGX signing key as trigger behind Taiko incident

ME News reported that on June 22 (UTC+8), BlockSec Phalcon published an initial assessment of the Taiko security incident. BlockSec said the likely cause was an SGX enclave signing key for Taiko's multiprover module, Raiko, being exposed on GitHub. Using the leaked key, the attacker allegedly registered SGX instances under their control, evaded the attestation verification process, and forged state and signature proofs. The attacker then used forged source signals to label fraudulent cross-chain messages as RETRIABLE and invoked retryMessage to withdraw canonical L1 assets from the ERC20Vault. (Source: Foresight News)