Off-Chain Breach Triggers Multichain Losses
Garden Finance temporarily took its cross-chain application offline after an attacker compromised the off-chain database of an independent solver and caused it to release funds for swaps that had not been funded by the other party.
The incident was initially described differently by blockchain security company Blockaid, which said on Sunday that an attacker had drained approximately $450,000 in Tether’s USDT from Garden-linked hash time-locked contracts, or HTLCs, across Ethereum, Base, Arbitrum and BNB Chain.
Blockaid described the activity as an ongoing exploit and published addresses associated with the attacker and affected contracts. Garden later clarified that the protocol’s smart contracts had not been exploited and that the loss remained limited to assets owned by one solver. The company was still confirming the final amount, affected assets and networks.
According to Garden, the attacker gained access to the solver’s off-chain database and inserted fraudulent transaction records. Those records reportedly made it appear that counterparties had funded legitimate swaps, leading the solver to release its own assets even though the corresponding funds had never been deposited.
Garden said no user assets were lost or placed at risk. It paused services while isolating the affected infrastructure, reviewing the incident and carrying out additional security checks.
The distinction between a contract exploit and a solver infrastructure breach is important because of the way Garden processes swaps.
Garden is an intent-based protocol that facilitates atomic swaps between Bitcoin and assets on other blockchains. Users submit a request to exchange one asset for another, and independent solvers compete to provide the required liquidity.
During a typical Bitcoin-to-USDC transaction, the user sends Bitcoin to an HTLC on the source network. A solver then locks USDC in another HTLC on the destination network. A cryptographic secret allows the parties to complete both sides of the transaction, while the time lock enables funds to be refunded if the swap fails.
Garden’s documentation says the solver should only be able to claim the user’s funds after fulfilling its side of the transaction. This structure is intended to keep users in control of their assets rather than requiring them to deposit money with a centralized bridge operator.
In the latest incident, however, the attacker appears to have manipulated information used by the solver before settlement rather than defeating the conditions enforced by the HTLC code.
Garden said it was working with zeroShadow, Quantstamp and Blockaid to trace and potentially recover the funds. The protocol expected to restore services after completing its security review but did not provide a firm reopening time.
The company also highlighted its recently obtained SOC 2 Type II attestation, which evaluates whether an organization has designed and consistently operated certain security and internal-control processes. Garden announced the attestation on July 13, less than two weeks before the latest incident.
The breach follows a much larger security incident involving another Garden solver on October 30, 2025.
In that case, an attacker compromised the solver’s operating environment and stole approximately $11.4 million in assets across several blockchains. Garden’s subsequent forensic report said the protocol contracts and user funds were unaffected because the stolen assets belonged to the solver.
An investigation involving EY found evidence of unauthorized access to the solver’s server. zeroShadow separately concluded that the incident originated from a leaked private key on a compromised device. Garden later introduced additional controls, including a wider network of independent solvers, infrastructure changes, vulnerability assessments and formal security requirements for solver operators.
The recurrence of an incident at the solver layer places renewed attention on the operational components surrounding Garden’s audited smart contracts. While the protocol’s non-custodial structure may have protected users from directly absorbing the loss, solvers remain essential to providing liquidity and completing swaps.
A failure affecting those operators can therefore interrupt the service even when the underlying contracts continue to function as designed.
The Smart Contracts Were Safe, but the System Still Failed
Garden’s clarification changes the technical description of the incident, but it does not make the event insignificant.
There is a major difference between a hacker finding a vulnerability in an HTLC and a hacker corrupting a solver’s database. The first would challenge the security of Garden’s settlement code. The second suggests that the cryptography may have worked perfectly while the surrounding operational system supplied it with false information.
That distinction matters to developers and auditors. It matters much less to a user who opens a cross-chain app and discovers that the service has been suspended because money was stolen.
“User funds were safe” is still the most important positive outcome. Garden’s separation between users and solvers appears to have limited the damage to the liquidity provider rather than spreading it to customers. That is a meaningful advantage of the protocol’s non-custodial design.
However, non-custodial does not mean risk-free.
A swap protocol is more than its deployed contracts. It also depends on databases, watchers, APIs, servers, signing systems and the operators providing destination-chain liquidity. An attacker does not need to break the strongest component when a weaker off-chain component can convince a solver to send real money against a fake transaction.
That is the real lesson from this incident. Smart contract audits can establish that code behaves correctly under expected inputs, but they cannot guarantee that every database entry, server session or operational instruction feeding the system is legitimate.
The October 2025 incident makes the latest breach harder to dismiss as an isolated event. The attack method appears different: the earlier loss was linked to a compromised operating environment and private key, while the latest case involved allegedly falsified database records. Still, both attacks reached Garden through an independent solver.
That repetition raises a fair question about whether security standards across the solver network are being implemented consistently enough.
Garden can accurately argue that neither incident compromised its core contracts. Yet repeated solver losses could still reduce liquidity, disrupt routes, increase operating costs and make professional market makers less willing to participate.
The SOC 2 attestation should also be viewed in the correct context. It can demonstrate that an organization maintains documented controls over a defined period. It is not a promise that every connected third party, solver or database will be impossible to breach.
Garden’s architecture appears to have done one crucial job: protecting users from becoming the direct victims. The next challenge is proving that the wider network surrounding those users is resilient enough to operate without repeated shutdowns.
In decentralized finance, the weakest link is often not the contract everyone can inspect. It is the off-chain system running quietly behind it.