BlockSec Phalcon reports that the recent security incident involving Taiko likely originated from the exposure of the SGX enclave signature key for its multi-verifier component, Raiko. The key was found publicly accessible on GitHub, creating a critical vulnerability in the system's integrity.

Attackers exploited this exposed credential to register maliciously controlled SGX instances, effectively bypassing standard verification mechanisms. By forging status and signature proofs, they manipulated the protocol to mark false cross-chain messages as 'RETRIABLE'. This manipulation allowed the invocation of the 'retryMessage' function, enabling the extraction of specified L1 assets from the ERC20Vault.