Garden Finance halts app after $450,000 HTLC exploit

Garden Finance disabled its application after blockchain security firm Blockaid published an alert reporting an attacker drained about $450,000 in USDT from the protocol’s hash time-locked contracts on Ethereum, Base, Arbitrum and BNB Smart Chain.

Blockaid’s alert noted the attacker moved roughly $450,000 from Garden’s HTLC contracts across the four networks. HTLCs are time-limited escrow contracts that lock funds until predefined conditions are met within a set window; Garden uses them to perform atomic swaps between Bitcoin and tokens on smart-contract platforms.

The security firm described the exploit as ongoing when it posted the notice and provided wallet addresses linked to the attacker and the affected contracts. The alert did not identify a specific vulnerability or confirm whether user-held funds beyond the drained USDT were affected.

Garden reported it had detected “unusual activity” and temporarily disabled its app while conducting a full investigation. The protocol’s team has not released technical details about how the breach occurred or whether other parts of its infrastructure were impacted.

In October 2025, an attacker stole about $11.4 million after compromising the operating environment of one of Garden’s solvers. At the time, Garden reported that breach did not affect protocol contracts or put user funds at risk. The current incident involves protocol-level HTLC contracts rather than a solver compromise.

Blockaid published attacker and contract addresses to help trace the flow of funds across chains. Both Garden and Blockaid are investigating the incident; neither has released a full technical postmortem or provided a timeline for returning the app to service.