Garden Finance took its application offline on July 27 after blockchain security firm Blockaid reported that an attacker had drained approximately $450,000 in USDT from the protocol's hash time-locked contracts, known as HTLCs. Blockaid said the theft spanned four networks: Ethereum, Base, Arbitrum and BNB Smart Chain.
HTLCs are time-bound escrow contracts that Garden Finance relies on to facilitate atomic swaps between Bitcoin and assets on other blockchains. Because the contracts sit at the center of how the protocol moves value across chains, a breach there strikes at the core of Garden's cross-chain swap mechanism rather than a peripheral feature.
An attacker drained about $450,000 in USDT from Garden's HTLC contracts.
Blockaid published wallet addresses linked to the attacker along with the affected contracts, but stopped short of disclosing the specific vulnerability that made the exploit possible. The firm's alert also did not clarify whether user funds beyond the drained USDT were affected, leaving that question open while Garden's team investigates.
Garden Finance Responds
Garden Finance confirmed it had “detected unusual activity” on its platform and said it was conducting a full investigation, taking the app temporarily offline as a precaution while the review continues. The team has not yet published a post-mortem detailing how the attacker gained access to the HTLC contracts.
Related: Triple-A Hot Wallet Hack Losses Climb to $11.8M as Drain Continues
A Second Breach in Under a Year
This is not Garden Finance's first security incident. In October 2025, the protocol suffered a far larger breach when an attacker stole roughly $11.4 million after compromising the operating environment of one of Garden's solvers. Garden noted at the time that the October breach did not affect its protocol contracts or user funds directly, pointing instead to the compromised solver infrastructure as the point of failure.
What Comes Next
With the app offline and an investigation underway, Garden Finance has not indicated a timeline for restoring service. The recurrence of a security incident within roughly nine months is likely to renew scrutiny of the protocol's infrastructure, even as the scale of this latest breach is a fraction of the October loss.
