Garden Finance reported that an external solver suffered a breach in its off-chain database. This incident forced the cross-chain bridge and atomic swap protocol to shut down its application temporarily. Blockaid identified that attackers extracted around $450,000 in USDT through Garden's hash time-locked contracts on Ethereum, Base, Arbitrum, and BNB Smart Chain. These HTLC setups function as timed escrow tools enabling atomic swaps between Bitcoin and tokens on other networks. Blockaid flagged the exploit as active and shared details on the attacker's addresses along with the affected contracts.

Third-Party Solver Issue Prompts Shutdown and Recovery Steps

Garden stated that no user funds were lost or placed at risk, with the impact limited to the solver's own assets. The team is assessing the full scope of affected funds, assets, and networks. Services were suspended as a safety measure during isolation and review of the compromised systems.

Attackers gained entry to an independent solver's off-chain database and inserted fraudulent transactions. This allowed the solver to release assets without corresponding deposits from the other party. Garden is collaborating with zeroShadow, Quantstamp, and Blockaid to trace and reclaim the funds. The protocol intends to resume operations after security checks conclude, though no specific timeline was given.

The company pointed to its recent SOC 2 Type II attestation as evidence of ongoing security commitments. This comes after an October 2025 incident in which nearly $11.4 million was taken by accessing the operating system of one of Garden's solvers. The firm noted that the earlier attack did not affect its core protocol contracts.

Blockaid had also flagged another set of incidents earlier this month involving two crypto bridges tied to the decentralized perpetual exchange AFX and Verus Protocol. Those events resulted in over $31.6 million lost across two separate exploits within hours. The AFX bridge on Arbitrum saw $24.15 million drained, while the Verus Ethereum Bridge lost about $7.5 million in cryptocurrency.