Garden Finance, a cross-chain bridge and atomic swap protocol, temporarily disabled its application after security firm Blockaid reported a $450,000 exploit affecting its Hash Time-Locked Contracts (HTLCs) across Ethereum, Base, Arbitrum, and BNB Smart Chain. The incident, first flagged on Sunday, initially appeared to involve a direct attack on the protocol's smart contracts, but subsequent clarification from Garden Finance indicated that the breach was limited to the off-chain infrastructure of an independent solver.
According to a spokesperson for Garden Finance, the attacker gained unauthorized access to a solver's off-chain database and injected fraudulent transaction records. This manipulation caused the solver to release funds for atomic swaps that had never been funded by the counterparty. The company emphasized that neither its core protocol nor its HTLC smart contracts were compromised, and that no user funds were lost or placed at risk. The total amount, assets, and networks involved are still being confirmed, but preliminary estimates from Blockaid placed the stolen value at approximately $450,000 in USDT.
How the Exploit Unfolded
Atomic swaps rely on a mechanism known as Hash Time-Locked Contracts (HTLCs) to ensure trustless exchange between different blockchain networks. In Garden Finance's architecture, independent solvers facilitate these swaps by maintaining off-chain databases that track transaction states. The attacker targeted one such solver, breaching its database and inserting fake records that indicated completed funding. As a result, the solver released the corresponding HTLC funds to the attacker before receiving the matching assets from the other side. This type of attack exploits a gap between on-chain security and off-chain operational trust, a vulnerability that has become increasingly common in decentralized finance (DeFi) ecosystems.
Blockaid's initial report described the exploit as ongoing and published a list of addresses associated with the attacker and the affected HTLCs. The report triggered widespread concern among users and liquidity providers, leading Garden Finance to temporarily suspend its application as a precautionary measure. The company stated that the pause was intended to isolate and review the affected infrastructure while ensuring that no further unauthorized transactions could occur.
Response and Recovery Efforts
Garden Finance is collaborating with blockchain security firms zeroShadow, Quantstamp, and Blockaid to trace and recover the stolen funds. The company has also initiated an internal security audit of its off-chain systems and expects to restore services shortly, subject to the completion of comprehensive security checks. Although no specific timeline has been provided, the protocol's leadership emphasized that resumption of operations will only occur after all relevant reviews are completed and the affected solver's infrastructure is secured.
The incident highlights a critical challenge in DeFi: the reliance on off-chain components that are not subject to the same level of cryptographic verification as on-chain smart contracts. While Garden Finance's HTLCs remain secure, the breach demonstrates that even the most robust on-chain protocols can be undermined by vulnerabilities in auxiliary systems. The company pointed to its recent SOC 2 Type II attestation as evidence of its commitment to security and operational controls, though this certification did not prevent the off-chain breach.
Previous Incidents and Industry Context
This is not the first time Garden Finance has faced such an attack. In October 2025, an attacker stole approximately $11.4 million after compromising the operating environment of one of its solvers. That incident, like the current one, did not affect the protocol's core smart contracts or user funds. The recurrence suggests a systemic risk inherent in the solver-based model, where independent operators manage sensitive off-chain data. Garden Finance has since implemented additional security measures, including regular audits and enhanced monitoring, but the latest breach indicates that further improvements are necessary.
The broader DeFi landscape has seen a surge in attacks targeting cross-chain bridges and atomic swap protocols. According to data from various blockchain security firms, losses from such exploits exceeded $2 billion in 2025 alone. Attackers often exploit weaknesses in off-chain databases, oracle manipulation, or misconfigured smart contracts. The rise of multi-chain ecosystems has increased the attack surface, as protocols must coordinate across different consensus mechanisms and programming environments.
Garden Finance's architecture is designed to minimize trust assumptions by using HTLCs, which enforce atomicity on-chain. However, the off-chain solver role introduces a point of centralization that can be targeted. To mitigate this, the protocol has diversified its network of solvers and requires them to undergo rigorous vetting. Despite these precautions, the latest incident underscores the difficulty of securing off-chain components against determined attackers.
Technical Details of the Attack
The attacker focused on USDT liquidity pools on four major EVM-compatible chains: Ethereum, Base, Arbitrum, and BNB Smart Chain. By inserting fraudulent swap records, the attacker tricked the solver into releasing funds from the HTLCs without the corresponding cross-chain transfer. The attack likely required detailed knowledge of Garden Finance's internal data structures and the solver's operational procedures. Blockchain security analysts suspect that the attacker may have obtained credentials or exploited a vulnerability in the solver's database management software.
Once the fraudulent records were injected, the solver's automated systems processed the swaps as legitimate, sending USDT to the attacker's addresses. The on-chain HTLCs executed their time-lock mechanism correctly, but the off-chain logic failed to verify the validity of the incoming transactions. This mismatch highlights the importance of end-to-end verification in multi-step protocols. Garden Finance has since implemented additional checks, including requiring solvers to confirm swap status through multiple independent sources before releasing funds.
Blockaid's monitoring systems detected unusual activity patterns and alerted the community. The firm's public disclosure of the affected contracts and attacker addresses helped limit further damage by enabling other solvers and liquidity providers to identify and block suspicious transactions. This rapid response underscores the value of real-time security monitoring in the DeFi space.
Impact and Market Reaction
The immediate impact on Garden Finance's operations was minimal in terms of user fund loss, but the reputational damage could be significant. Trust in the protocol may be shaken, especially among institutional investors who require high levels of security assurance. The temporary suspension of the app also disrupted regular swap services, causing inconvenience for users who rely on Garden Finance for cross-chain liquidity. Competitors such as Thorchain and Synapse Protocol may see an influx of users seeking alternative solutions while Garden Finance addresses the vulnerability.
The broader crypto market reacted relatively calmly to the news, with Bitcoin and Ethereum prices showing only minor fluctuations. This suggests that the market has become somewhat desensitized to individual DeFi exploits, viewing them as isolated incidents rather than systemic failures. However, regulators are likely to take note, as the incident reinforces concerns about the security of decentralized financial systems. Lawmakers in several jurisdictions have been scrutinizing DeFi protocols, and repeated breaches may accelerate calls for more stringent oversight.
Garden Finance has assured its user base that no personal or financial data was compromised in the attack. The company is also working with law enforcement agencies to identify the perpetrator. Given the pseudonymous nature of blockchain transactions, tracing the stolen funds back to a real-world identity remains challenging, but advances in on-chain analytics have improved recovery rates in recent years.
Lessons for the DeFi Industry
The Garden Finance exploit serves as a reminder that DeFi security must encompass both on-chain and off-chain components. Protocols that rely on third-party solvers or oracles should implement redundancy and multi-signature verification to reduce the risk of single points of failure. Regular penetration testing and bug bounty programs can also help identify vulnerabilities before they are exploited.
Furthermore, the incident highlights the need for standardized security practices among independent solvers. While Garden Finance vets its solvers, the decentralized nature of the network means that individual operators may have varying levels of security maturity. Protocols could consider requiring solvers to undergo mandatory security certifications or to maintain insurance coverage against potential losses. The SOC 2 Type II attestation that Garden Finance obtained is a step in the right direction, but it primarily applies to the company's own operations, not to those of its partners.
In the wake of the attack, several industry groups have called for the development of a shared framework for off-chain security in DeFi. Such a framework would define minimum standards for data storage, access control, and incident response. Collaboration between protocols, security firms, and regulators could help mitigate the risks that have plagued cross-chain bridges and atomic swap services.
As Garden Finance works to recover the stolen funds and restore its services, the broader community will be watching closely. The protocol's ability to bounce back from this incident will depend on its transparency, speed of response, and commitment to implementing lasting security improvements. For now, the focus remains on tracing the funds, isolating the affected solver, and ensuring that similar breaches are prevented in the future.
The attack on Garden Finance is a stark illustration of the evolving threat landscape in decentralized finance. While on-chain smart contracts have proven to be resilient, the off-chain infrastructure that supports them remains a weak link. Addressing this vulnerability will be essential for the long-term viability of cross-chain DeFi applications. Garden Finance's handling of the situation—its immediate suspension of services, collaboration with security firms, and transparent communication—sets a positive example for how protocols should respond to security incidents. However, the recurrence of such attacks suggests that fundamental changes in system design may be necessary to fully eliminate the risk.
Source:Cointelegraph News