Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5LSaGN…bkYXSummary
Garden Finance is a cross-chain atomic swap protocol that uses Hash Time-Locked Contracts (HTLCs) to facilitate trustless swaps between Bitcoin and EVM-chain assets. On July 26, 2026, an attacker compromised the off-chain database of an independent solver and inserted fraudulent transaction records, draining approximately $450,000 in USDT across Ethereum, Base, Arbitrum, and BNB Smart Chain. This was the protocol's second major security incident in under a year, following a substantially larger $11 million breach in October 2025 that involved a North Korea-affiliated threat actor group.
Connected Entities
8 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit→mentioned with→Arbitrum(70%)
- Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit→mentioned with→Garden(70%)
- Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit→mentioned with→Bitcoin(65%)
- Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit→mentioned with→ZachXBT(70%)
- Garden Finance Cross-Chain Bridge — July 2026 Solver Database Exploit→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Garden Finance→mentioned with→Arbitrum(70%)
- Garden Finance→mentioned with→Bitcoin(80%)
- + 13 more
Connected Through
7 shared actors · 619 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Arbitrumorganization
Timeline(7 events)
December 2023
Garden Finance launched as a cross-chain atomic swap protocol, developed by former RenBTC team members including co-founder Jaz Gulati.
Bitget Wallet30 October 2025
An attacker gained unauthorized access to the operating environment of one of Garden Finance's largest independent solvers, draining approximately $11.4 million in crypto assets. EY forensic investigation later confirmed suspicious SSH access from IP addresses in Japan and China. ZachXBT attributed the attack to the DPRK-affiliated DangerousPassword group.
The Register31 October 2025
Garden Finance publicly disclosed the October 2025 breach, temporarily shut down its application, and offered a 10% bounty to the attacker for return of funds.
The Register2 June 2026
ZachXBT published analysis on X alleging that over 80% of Garden Finance's recent fee revenue — 38.86 BTC collected over 12 days — derived from laundering funds stolen in the February 2025 Bybit hack, attributed to the Lazarus Group. Co-founder Jaz Gulati disputed the claim.
BitDegree26 July 2026
Blockaid detected an active, ongoing exploit on Garden Finance's HTLC contracts at approximately 9:30 PM UTC, flagging the attacker address (0x25b...6999) and approximately $450,000 in USDT drained across Ethereum, Base, Arbitrum, and BNB Smart Chain.
CoinTelegraph26 July 2026
Garden Finance took its application offline as a precaution and confirmed the exploit originated from the compromise of an independent solver's off-chain database. The team engaged zeroShadow, Quantstamp, and Blockaid to assist with asset tracing and recovery.
Crypto.news27 July 2026
Garden Finance issued a public statement confirming the breach was limited to the solver layer, that HTLC smart contracts were not compromised, and that no user funds were at risk. The team stated it was still verifying the total amount lost and provided no timeline for service restoration.
CryptoTimesDecision Log
- slot 445506484 · hash HPq2UUkTKiug9JUVi5q9pRD2HyuMrDqdezrEYyZzZoRA
- slot 443518092 · hash DUhH7BJqBEWcP834Q8iPFMw3KzMiKe5K8XVwmcHEnnNp
- slot 443518085 · hash CB1pT8K25m8HPXov39HcRK333SsRAUcz53HPLy8XJ1AZ
- slot 443504678 · hash 5uXrhm5FbaWSphqezMr6uv95HBm4DThcEpJPAs4CQgtw
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 15 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/7/2026, 12:20:31 PM
last updated: 8/25/2026, 10:47:36 PM
5 viewsavoid.net — verified advice for a post-truth world