[Updated July 27, 2026, 2:16 UTC: Revised to reflect clarifications from a Garden Finance spokesperson.]<\/p>\n
Garden Finance said an independent solver\u2019s off-chain database was compromised in an incident that prompted the cross-chain bridge and atomic swap protocol to temporarily take its app offline.<\/p>\n
On Sunday, Blockaid said<\/a> an attacker drained about $450,000 in USDT from Garden\u2019s hash time-locked contracts (HTLC) on Ethereum, Base, Arbitrum and BNB Smart Chain. HTLCs are time-bound escrow contracts that Garden uses to facilitate atomic swaps between Bitcoin and assets on other networks. Blockaid described the exploit as ongoing and published addresses linked to the attacker and affected contracts.<\/p>\n However, a Garden Finance spokesperson told Cointelegraph that neither the protocol nor its HTLC smart contracts had been compromised. The company said the attacker breached the off-chain database of an independent solver and inserted fraudulent transaction records, causing the solver to release funds for swaps that had not been funded by the counterparty.<\/p>\n Garden said no user funds were lost or placed at risk and that the incident affected only solver-owned assets. The company is still confirming the total amount, assets and networks involved. It said services were paused as a precaution while the affected infrastructure was isolated and reviewed.<\/p>\n Blockaid acknowledged Cointelegraph\u2019s request for comments.\u00a0<\/p>\n Garden said it is working with zeroShadow, Quantstamp and Blockaid to trace and recover the funds. The protocol expects to restore services<\/a> shortly, subject to completing security checks, but did not give a specific timeline.<\/p>\n \u201cGarden\u2019s protocol and HTLC smart contracts were not compromised, and no user funds were lost or at risk,\u201d the company told Cointelegraph, adding that the incident was isolated to the off-chain infrastructure of one solver in its network of independent solvers.<\/p>\n The company also pointed to its recent SOC 2 Type II attestation as evidence of its investment in security and operational controls. Garden told Cointelegraph that its immediate priorities are securing the affected systems, tracing the solver\u2019s funds and ensuring services resume only after the relevant reviews are completed.<\/p>\n Related: <\/strong><\/em>WEMIX says attacker moved about $724,000 after contract breach<\/strong><\/em><\/a><\/p>\n The incident follows<\/a> an October 2025 breach in which an attacker stole about $11.4 million after compromising the operating environment of one of Garden\u2019s solvers. Garden said that incident also did not affect its protocol contracts or put user funds at risk.<\/p>\n Magazine: <\/strong><\/em>Inside the \u2018fake police raid\u2019 that forced a $1M Bitcoin transfer<\/strong><\/em><\/a><\/p>\nGarden works with security firms to trace funds<\/h2>\n