TAIKO climbed 96.7 percent this week while the rest of its sector fell. Six days ago the token touched an all-time low of six cents, three days after a stranger drained its bridge vault.
The stranger did not brute-force anything. He forged a proof, using a signing key that Taiko’s own engineers had left reachable on GitHub.
One point seven million dollars gone. Chain halted. Withdrawals frozen mid-transaction for anyone who had not already pulled their funds out first.
A Vault Built to Hold the Bridge
Etherscan lists the exact address that got drained. It shows up today labeled Taiko: ERC20 Vault, sitting at rank three among all TAIKO holders with 110,517,819 tokens, worth roughly $17.8 million at this reporting’s $0.1612 price. That single wallet backs every asset that has ever crossed onto the Taiko network from Ethereum.
On June 28, the verified Taiko.eth account posted a four-step plan to reopen the chain. Step two read plainly: replenish the bridge so every L2 asset is backed 1:1, verifiable on-chain by anyone. No user will lose funds, the post said. Someone still had to cover that gap.
DeFiLlama’s own hack registry logs the incident under Taiko Bridge, dated June 21, 2026, amount $1.7m, classified as Protocol Logic with the technique listed as Fake Proof Exploit. The public disclosure post went out the following morning, June 22 at 3:44 AM UTC, so this piece treats June 22 as the day the market learned about it while noting the underlying exploit is dated a day earlier. The pattern is not unique to Taiko. Gravity Bridge lost $5.4 million after its own validators signed off on a forged instruction, and Stake DAO watched an attacker mint 5.4 trillion tokens on Arbitrum through a single leaked private key. Bridges keep failing the same way: a verification step trusted a piece of data it should not have.
The Fix Traces to One Leaked Key
BlockSec, the security firm that reviewed the incident, told CoinDesk the root cause pointed to a signing key for Raiko, the software Taiko uses to generate proofs that certify a withdrawal is genuine. That key had sat reachable in a public repository.
The commit history backs it up. On June 25, a Taiko contributor working under the handle johntaiko pushed a fix labeled fix(release): fetch sgx signing key from gcp. Bundled into the same pull request: chore(release): remove leaked mrsigner sample. Four days later a second commit, fix(sgx): validate GuestInput inside raiko2-sgx, added checks so the enclave verifies what it is signing before it signs it.
Not a patch note. A confession, buried in a diff.
Seventeen Thousand Dollars Holds the Chain
Run the numbers on DEX Screener and the on-chain side of TAIKO still looks close to empty. Eight active pools carry real liquidity, spread across Uniswap and PancakeSwap. Add every dollar of liquidity in those eight and the total comes to $17,459.44. The single biggest pool holds $11,503.93, and it was created about an hour after the June 22 disclosure post.
A second look at the token turned up four brand-new TAIKO/USDC pools, all created within roughly an hour of each other on July 1, all reporting exactly $0 in stated liquidity despite carrying live trades, and all pricing TAIKO differently: $0.04954, $0.09873, $0.1359 and $0.1399 within the same few minutes. That is close to a threefold spread for the same token at the same moment. It may reflect genuinely negligible depth in fresh Uniswap V4 concentrated-liquidity pools, or a lag in how DEX Screener indexes brand-new pairs. Either read points the same direction: price discovery for TAIKO on-chain is thin and inconsistent enough that no single DEX quote should be trusted on its own.
CoinGecko shows 24-hour trading volume of $91.2 million against a $32.9 million market cap, a ratio above 275 percent. Almost none of that volume runs through the pools above. Upbit’s TAIKO/KRW pair alone processed $47.1 million of it, just over half the total. This is a centralized-exchange rally sitting on top of a chain where on-chain price discovery is fragmented and thin.
Try selling any real size into the pools themselves and the slippage would eat you alive.
Three Wallets, Not One Anonymous Whale
TAIKO has 2,722 holders on Ethereum. The top 100 of them control 93.91 percent of supply, and the top five alone hold 68.49 percent, according to Etherscan’s own tally, recorded during the first research pass and not expected to shift meaningfully within hours.
None of the top three are unlabeled. treasury.taiko.eth holds 28.91 percent (289,065,639 tokens, roughly $46.6 million at this reporting’s price). masters.taiko.eth holds 21.53 percent (215,296,911 tokens, roughly $34.7 million). Taiko: ERC20 Vault, the address from the hack, holds 11.05 percent, the $17.8 million already mentioned. A fourth wallet, 0x3c12e4A3…63D3d6771, holds 4.22 percent and sits below the threshold this outlet treats as requiring a full identity check.
That is not the same finding as most token-concentration stories carry. It removes the anonymous-whale angle entirely. It does not remove the concentration itself.
TAIKO’s Chain Has No Mint Switch
The verified contract behind TAIKO, read line by line rather than guessed from its function names, mints exactly once. The init() function called at deployment creates 1,000,000,000 tokens and nothing after it. No mint(), no pause(), no blacklist() function exists anywhere in TaikoToken or in the base contract it inherits from.
That is worth stating outright, because plenty of token stories this year have ended with a hidden owner function nobody read the source for. This one did not have one to find. Whatever went wrong with TAIKO happened a layer up, inside the bridge and its proof system, not inside the token contract itself.
Tokenomics tell the same clean story. Tokenomist lists 198,033,736 TAIKO unlocked, 19.80 percent of total supply, on a linear vesting schedule with no discrete cliff due. That figure lines up with CoinGecko’s own circulating count of roughly 198.17 million almost exactly, which rules out the quiet-extra-minting problem that shows up in some of this outlet’s other coverage.
The Peers Went the Other Way
CoinGecko’s own comparison put the Smart Contract Platform category down 3.6 percent over the same seven days TAIKO gained 96.7. The broader crypto market slipped 0.6 percent in that window. OpenLedger, Hermez Network, PHALA, Cartesi and BSquared Network, five tokens CoinGecko lists as related to TAIKO, each moved under 6 percent in the trailing twenty-four hours.
Whatever drove this move, it belonged to Taiko alone.
What Nobody Has Confirmed Yet
Whether the ERC20 Vault has actually been topped back up to a full 1:1 backing, the way the June 28 post promised, is not something Etherscan states outright. The wallet holds 110.5 million tokens today. What it held the hour before the hack is not public record either, at least not anywhere this reporting turned up.
Reaction on X split about the way you would expect it to. A user posting as Jami3 called the chain a “SHITCOIN SCAM” and demanded Bybit delist it. Another, posting as Stephanie So, wrote that the team “handled communications really well.” CoinGecko’s own sentiment poll told two different stories across this reporting’s two passes: 82 percent bullish, 18 percent bearish on the first pass, and 59 percent bullish, 41 percent bearish roughly three hours later, even as the price kept climbing. Conviction is softening while the chart still goes up.
The chain is back online. The vault says it is whole. Nobody outside Taiko can independently confirm that second part yet.
────────────────────────────────────────────────────────────
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk, including the total loss of capital. Always conduct your own research.
────────────────────────────────────────────────────────────
Research Notes
Research was conducted in two passes on July 1, 2026: an initial pass around 15:00 UTC and a corrected, re-verified pass around 18:00 UTC after an internal accuracy review. Figures below reflect the second pass unless noted. All figures are point-in-time snapshots; TAIKO was moving fast enough during this reporting that numbers shifted materially between the two passes, and may have moved again by the time this is read.
Correction Log
- Fixed an arithmetic error: the original draft stated total DEX liquidity as “$15,015.” The correct sum of the original 8-pool API pull was $14,842.51. By the second research pass, actual liquidity in those same pools had grown to $17,459.44.
- Added screenshot evidence for two claims that previously had none: the multi-pool DEX Screener view (Fig. 5) and the CoinGecko Markets tab showing Upbit’s volume share (Fig. 7).
- Clarified the “same day as the hack” claim: DeFiLlama lists the hack date as June 21; the public disclosure post went out June 22 at 3:44 AM UTC; the largest liquidity pool was created about an hour after that post, one day after DeFiLlama’s listed hack date.
- Disclosed a new finding from the second pass: 4 additional TAIKO/USDC pools appeared within roughly an hour of each other, all with $0 stated liquidity and a near-3x price spread between them.
- Refreshed all live market figures (price, market cap, FDV, volume, sentiment poll) to the second pass, since the first pass’s numbers were already stale by the time of the accuracy review.
CoinGecko Data (second pass, ~18:00 UTC)
Token: Taiko (TAIKO)
CoinGecko rank: #537 to #539 (fluctuating)
Price: $0.1612 (also shown as $0.1608 in a separately-cached page block)
24h change: +119.4% (hero figure); +116.4% shown elsewhere on the same page
7d change: +96.70% (also shown as +91.64% elsewhere on the same page)
ATH: $3.80 — June 5, 2024 (about 2 years ago), now 95.7% below that peak
ATL: $0.06031 — June 25, 2026 (6 days before first pass)
Market cap: $32,949,399 (live converter widget) vs. $24,500,997 (separately-cached FAQ text on the same page load, apparently computed off a stale price around $0.1236) — used the live converter figure as more current
FDV: $166,271,557 (live converter) vs. $123,638,641 (stale FAQ text)
FDV/MC ratio: ~5.05x
Circulating supply: 198,166,179 TAIKO
Total / Max supply: 1,000,000,000 TAIKO
24h trading volume: $91,246,865 (live converter); $75.8M and $73.9M shown in other cached blocks on the same page
Volume/MC ratio: ~277% using live-converter figures — FLAG
TVL: $15,934,588 (CoinGecko’s embedded, apparently cached figure) vs. $18.09M on DeFiLlama’s own page directly — used DeFiLlama’s primary-source figure in the body
Sentiment poll: 82% bullish / 18% bearish (first pass) → 59% bullish / 41% bearish (second pass, ~3 hours later)
Chain: Ethereum
Contract: 0x10dea67478c5f8c5e2d90e5e9b26dbe60c54d800
CEX listings: Upbit (TAIKO/KRW, $47.1M 24h vol, ~51% of volume), Bithumb, Gate, OrangeX, Bybit, KuCoin, HTX, Biconomy, Toobit, LBank and others
CoinGecko banner: “Taiko’s chain state verification mechanism has been compromised” with link to the June 22 security notice, still displayed as of the second pass
Sector Peers (second pass)
- Global crypto market: 7d -0.60%
- Smart Contract Platform category: 7d -3.60%
- OpenLedger: 24h +4.9%
- Hermez Network: 24h +0.6%
- PHALA: 24h +0.1%
- Cartesi: 24h +5.3%
- BSquared Network: 24h +4.5%
TAIKO moved 96.7% over 7 days while its own sector fell. Token-specific event confirmed, not a sector rotation.
DEX Screener — Full Pool Extract (second pass, re-pulled via API)
Total pairs returned by API: 12 (up from 8 on the first pass)
Pool 1 (largest): Uniswap, TAIKO/USDT, Liq $11,503.93, Vol24h $20,871.44, created 2026-06-22 04:43 UTC
Pool 2: Uniswap, TAIKO/USDT, Liq $2,753.16, Vol24h $1,484.55, created 2026-01-06
Pool 3: PancakeSwap, TAIKO/WETH, Liq $14.95, Vol24h $77.55, created 2024-06-11
Pools 4-8: Combined liquidity ~$3,187; created between 2024-12-20 and 2026-06-22
Total liquidity, 8 active pools: $17,459.44 (recomputed and verified by direct summation; original published figure of “$15,015” was a math error, corrected)
4 additional pools (new): All TAIKO/USDC on Uniswap, created within about an hour of each other on July 1, 2026 (2026-07-01 17:25 to 17:59 UTC), all reporting $0 stated liquidity, prices ranging $0.04954 to $0.1399 (a near-3x spread) despite small nonzero trading volume ($275-$463 each)
Liquidity/MC ratio: ~0.053% (using the 8 active pools and the $32.9M live market cap) — FLAG (well under 1%)
Wash-trading check: Transaction counts too low across the thin pools for a reliable bot-pattern read; the 4 new $0-liquidity pools cannot be assessed for wash trading at all given DEX Screener reports no liquidity depth for them
DeFiLlama
TVL: $18.09M (Taiko Bridge protocol page, consistent across both research passes)
Market Cap (DeFiLlama’s own figure): $27.85M
FDV (DeFiLlama’s own figure): $140.66M
Fees/Revenue: No fees tab available for this bridge protocol
Hack entry: Date Jun 21, 2026 | Amount $1.7m | Classification: Protocol Logic | Technique: Fake Proof Exploit | Language: Solidity | Target: DeFi Protocol
Official Website and Team
Website: taiko.xyz
Team check: No individual names listed on the official About page. Taiko frames itself as DAO-governed and “ownerless” by design, a governance choice distinct from a red-flag anonymous team given the project’s multi-year public track record, prior funding rounds ($15M in 2024, $22M reported separately), and listings on Binance Futures, Bybit, KuCoin and others since 2024.
Official announcement check (72h window): Confirmed. The June 28 restoration post from @taikoxyz is the primary catalyst for the current price move, not an on-chain signal discovered independently.
Tokenomics (Tokenomist.ai)
Allocation: DAO Treasury 22.68%, Taiko Labs / Core Team 20.00%, Taiko Foundation Reserve 16.88%, Investors 11.62%, Trailblazer Airdrop 10.00%, Initial Liquidity & Market Making 5.00%, Grants & RetroPGF 5.00%, Genesis Airdrop 4.32%, Guardian Prover Bonds 2.00%, Taiko Masters Prover Bonds 1.50%, Protocol Guild Airdrop 1.00%
Circulating (Tokenomist calculated): 198,033,736 TAIKO (19.80%)
Circulating (CoinGecko self-reported): 198,166,179 TAIKO
Reconciliation: The two figures differ by under 0.1%. No evidence of minting beyond schedule.
Vesting type: Linear, no discrete cliff currently due
TGE Verification (GeckoTerminal)
Earliest pool: TAIKO/WETH, created 2024-06-11T11:54:23Z
Cross-check: Matches CoinGecko’s recorded ATH date of June 5, 2024, within days
Etherscan — Holder Distribution (first pass; unlikely to shift within hours)
Total holders: 2,722
Top 100 concentration: 93.91%
Top 5 concentration: 68.49%
Top 10 concentration: 74.86%
Holder Math Audit (top 5 wallets, all individually above 5% except #4; dollar values recomputed at the second pass’s $0.1612 price, token counts unchanged from first pass):
- #1 treasury.taiko.eth: 289,065,639.86 — 28.9066% — ~$46,605,979 at $0.1612 — labeled ENS, matches TAIKO_FOUNDATION_TREASURY constant in verified source
- #2 masters.taiko.eth: 215,296,911.00 — 21.5297% — ~$34,705,858 at $0.1612 — labeled ENS
- #3 Taiko: ERC20 Vault: 110,517,819.87 — 11.0518% — ~$17,815,473 at $0.1612 — Etherscan label, matches TAIKO_ERC20_VAULT constant in verified source, and is the exact address drained in the June 22 hack
- #4 0x3c12e4A3…63D3d6771: 42,210,318.83 — 4.2210% — ~$6,804,304 at $0.1612 — unlabeled, below the 5% threshold for a full identity workup
Sum of top 3 alone: 28.9066 + 21.5297 + 11.0518 = 61.49%. Top 5 (per Etherscan’s own stated figure): 68.49%. Every wallet above 5% carries an explicit label; none is an anonymous whale.
Contract Safety — Source Code Review
Contract type: UUPS upgradeable proxy (ERC1967), implementation at 0x5C96Ff5B7f61b9e3436Ef04Da1377c8388dfC106
Compiler: 0.8.30+commit.73712a01, verified on Etherscan via Blockscout API cross-check
Write Contract tab (proxy): “Contract ABI methods are not available, no public Write functions found” — standard for a minimal proxy
mint(): Not present as a callable function. Supply is minted once inside init(), an initializer-gated function callable only at deployment (1,000,000,000 tokens, hardcoded).
pause() / blacklist(): Not present anywhere in TaikoToken.sol or TaikoTokenBase.sol
Cap: Fixed at 1,000,000,000 TAIKO by the one-time _mint() call; no ongoing mint path exists to raise it
Mintable remaining: 0 tokens
Security audit: No third-party audit badge surfaced on the Etherscan contract page during this review
GitHub — Commit Activity
Org: taikoxyz (129 repositories, 8k followers)
June 25, 2026: raiko2 commit 9357c90 — “fix(release): fetch sgx signing key from gcp (#105)” — sub-commits include “chore(release): remove leaked mrsigner sample” and “docs(release): split zk and tee release notes”
June 26, 2026: raiko2 commit 68b10d6 — “fix(guest): harden proof soundness checks (#107)” — rejects fake aggregation receipts, enforces anchor and base fee soundness
June 29, 2026: raiko2 commit 1673f6a — “fix(sgx): validate GuestInput inside raiko2-sgx (#100)” — validates guest input before signing, hardens shasta remote request validation
June 30, 2026: raiko2 commits #118, #120, #121 — orphaned task cleanup and pipeline fixes, authored same day the network reportedly came back online
Supply Math Summary (second pass)
Circulating supply (CoinGecko): 198,166,179 TAIKO
Total supply (on-chain, fixed): 1,000,000,000 TAIKO
Max supply / hard cap: 1,000,000,000 TAIKO (no mint() function exists to exceed it)
% of cap issued: 100% (all 1B tokens exist on-chain; the remainder sits in vesting/treasury wallets, not un-minted)
Tokens still mintable: 0
Current price: $0.1612
Market cap: $32.9M (live) / $24.5M (stale cached figure on the same CoinGecko page)
FDV: $166.3M (live) / $123.6M (stale cached figure)
FDV/MC ratio: ~5.05x
Primary pool liquidity: $11,503.93
Total DEX liquidity, 8 active pools: $17,459.44 (corrected sum)
Additional pools with $0 stated liquidity: 4, all created within the hour before the second pass
Liquidity/MC ratio: ~0.053%
Total holders: 2,722
Top 100 control: 93.91%
Named wallets (top 3): treasury.taiko.eth 28.91%, masters.taiko.eth 21.53%, Taiko: ERC20 Vault 11.05%
Unlabeled wallet (#4): 1 wallet, 4.22%, ~$6.8M at current price — below the 5% deep-dive threshold
Dilution statement: with no mint() function present, there is no path for the circulating float to be diluted beyond the fixed 1,000,000,000 TAIKO already on-chain. The dilution risk in this token sits entirely in vesting timing, not contract-level inflation.
Claims Verification Audit
- Price $0.1612, 24h +119.4%, 7d +96.70% — CoinGecko, second pass — taiko_coingecko_overview2.png — VERIFIED
- CoinGecko shows internally inconsistent cached figures on the same page (market cap $32.9M vs $24.5M; volume $91.2M vs $75.8M vs $73.9M) — flagged rather than silently resolved — VERIFIED as a data-quality finding
- Sector peers moved differently (-3.6% category vs +96.7% token) — CoinGecko — taiko_coingecko_overview2.png — VERIFIED
- Total DEX liquidity $17,459.44 across 8 active pools — DEX Screener API, re-pulled and independently re-summed — VERIFIED, math checked twice
- 4 new $0-liquidity pools with a near-3x price spread — DEX Screener API + browser screenshot — taiko_dexscreener_search_allpairs.png — VERIFIED as displayed; underlying cause (thin pool vs indexing lag) explicitly labeled uncertain
- Upbit carries ~51% of 24h volume ($47.1M) — CoinGecko Markets tab — taiko_coingecko_markets_tab.png — VERIFIED (previously this claim had no screenshot; now corrected)
- Total holder count 2,722 — Etherscan — taiko_etherscan_holders.png — VERIFIED
- Top 3 wallets sum to 61.49%, top 5 to 68.49% — Etherscan + manual audit — taiko_etherscan_holders.png — VERIFIED
- No unlabeled wallet above 5% claimed as anonymous whale — Etherscan — VERIFIED (all top-3 labeled)
- mint() does not exist as ongoing function — Etherscan verified source (Blockscout API) — taiko_etherscan_source_code.png — VERIFIED
- pause() / blacklist() do not exist — source code read — taiko_etherscan_source_code.png — VERIFIED
- Cap fixed at 1B, no mint path — source code read — taiko_etherscan_source_code.png — VERIFIED
- Mintable remaining = 0 — source code math — VERIFIED
- No third-party audit badge found — Etherscan contract page — noted — VERIFIED (absence noted, not asserted as guaranteed absent elsewhere)
- TGE June 11, 2024 — GeckoTerminal — taiko_geckoterminal_tge.png — VERIFIED
- Official announcement (June 28 restoration post) is the primary catalyst — X — taiko_x_june28_restore.png — VERIFIED
- GitHub commit content described exactly (SGX key fetch, leaked mrsigner sample) — GitHub — taiko_github_repos.png — VERIFIED
- DeFiLlama hack entry: $1.7m, June 21, 2026, Fake Proof Exploit — DeFiLlama, both passes consistent — taiko_defillama_tvl2.png — VERIFIED
- Tokenomics reconciliation (198.03M vs 198.17M) — Tokenomist — taiko_verify_tokenomics.png — VERIFIED
- Sentiment poll shift 82%→59% bullish across the two passes — CoinGecko sentiment widget, screenshotted both times — VERIFIED
