Taiko Ethereum ERC20 Vault attacked, with losses exceeding $1 million

According to Blockaid monitoring, Taiko’s ERC20 Vault on Ethereum was attacked, resulting in losses exceeding 1 million US dollars. The vulnerability stemmed from a flaw in the source signal proof verification of Taiko’s cross-chain bridge, where constructed message proofs were accepted as valid on Ethereum L1 without requiring a corresponding legitimate MessageSent event on the Taiko source chain. This enabled attackers to register and extract fraudulent cross-chain messages, unauthorizedly releasing assets from the ERC20 Vault.