[Updated July 27, 2026, 2:16 UTC: Revised to reflect clarifications from a Garden Finance spokesperson.]
Garden Finance said an independent solver’s off-chain database was compromised in an incident that prompted the cross-chain bridge and atomic swap protocol to temporarily take its app offline.
On Sunday, Blockaid said an attacker drained about $450,000 in USDT from Garden’s hash time-locked contracts (HTLC) on Ethereum, Base, Arbitrum and BNB Smart Chain. HTLCs are time-bound escrow contracts that Garden uses to facilitate atomic swaps between Bitcoin and assets on other networks. Blockaid described the exploit as ongoing and published addresses linked to the attacker and affected contracts.
However, a Garden Finance spokesperson told Cointelegraph that neither the protocol nor its HTLC smart contracts had been compromised. The company said the attacker breached the off-chain database of an independent solver and inserted fraudulent transaction records, causing the solver to release funds for swaps that had not been funded by the counterparty.
Garden said no user funds were lost or placed at risk and that the incident affected only solver-owned assets. The company is still confirming the total amount, assets and networks involved. It said services were paused as a precaution while the affected infrastructure was isolated and reviewed.
Blockaid acknowledged Cointelegraph’s request for comments.
The Bigger Picture for Cross-Chain Bridges
This incident lands in a rough year for cross-chain infrastructure broadly. Bridges as a category lost more than $1.31 billion across 344 separate incidents in just the first half of 2026, according to industry tracking.
Garden’s case is a useful illustration of why that number stays high: even protocols with genuinely solid contract security can still lose funds through the humans and off-chain systems sitting adjacent to those contracts.
Garden works with security firms to trace funds
Garden said it is working with zeroShadow, Quantstamp and Blockaid to trace and recover the funds. The protocol expects to restore services shortly, subject to completing security checks, but did not give a specific timeline.
“Garden’s protocol and HTLC smart contracts were not compromised, and no user funds were lost or at risk,” the company told Cointelegraph, adding that the incident was isolated to the off-chain infrastructure of one solver in its network of independent solvers.
The company also pointed to its recent SOC 2 Type II attestation as evidence of its investment in security and operational controls. Garden told Cointelegraph that its immediate priorities are securing the affected systems, tracing the solver’s funds and ensuring services resume only after the relevant reviews are completed.
Related: WEMIX says attacker moved about $724,000 after contract breach
The incident follows an October 2025 breach in which an attacker stole about $11.4 million after compromising the operating environment of one of Garden’s solvers. Garden said that incident also did not affect its protocol contracts or put user funds at risk.
Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer.
FAQ
Were Garden Finance user funds affected by this exploit?
Garden says no the company states user funds were not lost or placed at risk, and that the roughly $450,000 drained belonged to the affected solver, not to platform users.
What’s the difference between the protocol being hacked and a solver being hacked?
Garden’s smart contracts (the protocol) handle the actual atomic swaps and were not compromised. A solver is a separate, independent party that executes swap orders in this case, an attacker broke into that solver’s own off-chain database, not Garden’s on-chain infrastructure.
Has this happened to Garden Finance before?
Yes in October 2025, a different Garden solver was compromised in a breach that resulted in roughly $11.4 million in losses, also described as not affecting the core protocol or user funds.
