Audit log

Every state-changing event for Garden: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 03:30:48Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,904,985

   sig

   2Vzre7MKV4d7…cE4ndtDRcopyexplorer ↗

   hash

   2VeoMfD44GqU…YAgBzvPhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6588 B) ▸

   {"actor":"system:backfill","investigation_id":"af469430-2d96-4ad7-80a1-b893bf5d3479","kind":"publish","page_slug":"garden","published_at":"2026-05-20T03:30:48.923Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Garden","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theregister.com/2025/10/31/attackers_dig_up_11m_in/"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/25-garden-finance-funds-linked-175501426.html"},{"credibility":3,"name":"","type":"other","url":"https://forum.arbitrum.foundation/t/garden-finance-ltipp-application-final/21926"},{"credibility":3,"name":"","type":"other","url":"https://docs.garden.finance/home/governance/tokenomics"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://garden.finance/blog/what-are-htlcs"},{"credibility":3,"name":"","type":"other","url":"https://www.garden.finance/"},{"credibility":3,"name":"","type":"other","url":"https://docs.garden.finance/home/governance/tokenomics"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://github.com/gardenfi/audits"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/356301/garden-finance-shares-forensic-findings-security-breach-limited-to-solver-layer"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/press-releases/387636/garden-finance-shares-forensic-findings-security-breach-limited-to-solver-layer"},{"credibility":3,"name":"","type":"other","url":"https://www.theregister.com/2025/10/31/attackers_dig_up_11m_in/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-october-2025"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theregister.com/2025/10/31/attackers_dig_up_11m_in/"},{"credibility":3,"name":"","type":"other","url":"https://find-and-update.company-information.service.gov.uk/company/09763192/officers"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/garden-finance-exploit-drains-over-10m-across-multiple-chains/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theregister.com/2025/10/31/attackers_dig_up_11m_in/"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/25-garden-finance-funds-linked-175501426.html"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/356301/garden-finance-shares-forensic-findings-security-breach-limited-to-solver-layer"},{"credibility":3,"name":"","type":"other","url":"https://cybernews.com/crypto/btc-bridge-flagged-laundering-money-hacked/"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/garden-finance-exploit-drains-over-10m-across-multiple-chains/"},{"credibility":3,"name":"","type":"other","url":"https://www.xt.com/en/blog/post/zachxbt-accuses-garden-finance-of-laundering-funds-from-bybit-hack"}]}],"sources_used":[],"summary":"Garden Finance (garden.finance) is a Bitcoin cross-chain bridge and swap protocol launched in December 2023 by former Ren Protocol core team members, using Hashed Timelock Contracts (HTLCs) and an intents-based solver network to enable non-custodial Bitcoin swaps across chains. In October 2025, a compromised solver operator lost approximately $11.4 million in a security incident attributed by forensic investigators to a North Korea-linked threat actor. Prior to the exploit, blockchain investigator ZachXBT alleged that a substantial portion of Garden's volume — with estimates ranging from 25% to over 75% — originated from illicit sources including funds stolen in the $1.46 billion Bybit hack by Lazarus Group, allegations the team disputed but did not fully refute.","timeline":[{"date":"2017-01-01","event":"Republic Protocol (later Ren Protocol), predecessor project to Garden Finance, founded in Australia by Taiyang Zhang, Loong Wang, and Jaz Gulati.","source":""},{"date":"2022-11-01","event":"FTX, which had acquired Ren Labs, files for bankruptcy. Ren Protocol collapses, prompting Gulati and Nadimpalli to begin work on Garden Finance.","source":""},{"date":"2023-12-01","event":"Garden Finance publicly launches as a Bitcoin cross-chain bridge using HTLC atomic swaps and an intents-based solver network.","source":""},{"date":"2024-01-18","event":"SEED governance token launches with a total supply of 147 million tokens. Team and investor allocations subject to 24-month cliff from TGE.","source":""},{"date":"2025-02-21","event":"Bybit exchange suffers a $1.46 billion hack attributed to North Korea's Lazarus Group. ZachXBT later alleges $160 million of these stolen funds transited Garden within 48 hours.","source":""},{"date":"2025-06-21","event":"ZachXBT publicly alleges that more than 80% of Garden Finance's recent fee income was generated from facilitating movement of Lazarus Group-linked Bybit stolen funds. Garden co-founder Jaz Gulati disputes the characterization.","source":""},{"date":"2025-07-01","event":"ZachXBT publishes a broader analysis alleging 25% or more of Garden's total historical volume is linked to stolen assets, with six-figure profits from illicit flows between April and July 2025.","source":""},{"date":"2025-10-30","event":"Security breach: an attacker gains unauthorized access to the private key infrastructure of a major Garden solver operator and drains approximately $11.4 million in WBTC, USDC, USDT, and ETH across multiple chains. Garden temporarily shuts down its app.","source":""},{"date":"2025-10-31","event":"Garden co-founder Jaz Gulati states user funds are safe and the protocol remains unaffected. Garden offers a 10% whitehat bounty (~$1.1M) for fund return and exploit disclosure. ZachXBT alleges the compromised solver was operated by a Garden team member based on on-chain evidence from a deployer address.","source":""},{"date":"2026-01-29","event":"Garden publishes forensic findings from Ernst and Young and zeroShadow, confirming unauthorized server access from IP addresses located in Japan and China on October 30, 2025, with the compromise attributed to a leaked private key on a compromised device. The attacker is linked to North Korea-affiliated threat actor DangerousPassword (also known as CryptoCore / Sapphire Sleet / UNC1069). No funds recovered.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3f738014-27ad-4410-8def-ed50a446866bcopy
2. #2rescoreby systemsystem

   2026-10-10 18:49:19Z
   Score: 14 → 59 (+45)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 14 → 59. Problems weighed by who is responsible: the subject's own conduct −16, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +10, regulated +5.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,354

   sig

   5kje4xmcTuGB…eH6f67Zgcopyexplorer ↗

   hash

   2ZvWZ8svHvWf…8mmpmFCCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (649 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:19.368Z","decision":"rescore","investigation_id":"af469430-2d96-4ad7-80a1-b893bf5d3479","new_score":59,"page_slug":"garden","prev_score":14,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 14 → 59. Problems weighed by who is responsible: the subject's own conduct −16, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +10, regulated +5.","score_delta":45,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d602a0be-d997-41dd-81f4-938648f32a25copy
3. #3rescoreby systemsystem

   2026-11-01 22:52:22Z
   Score: 59 → 26 (-33)
   Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 26. Problems weighed by who is responsible: the subject's own conduct −40, incidents the subject suffered −18, concerns that are not fraud −3.2, problems around the subject, caused by others −1.4; legitimacy credit long-running +10, regulated +5; no established finding that it defrauded anyone, so it stays out of the red band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,266,865

   sig

   4zKYTtFcQZiv…iPxgf9Escopyexplorer ↗

   hash

   Fe9VBSW2GDwm…oVcRbnrFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (833 B) ▸

   {"actor":"system","decided_at":"2026-11-01T22:52:21.869Z","decision":"rescore","investigation_id":"af469430-2d96-4ad7-80a1-b893bf5d3479","new_score":26,"page_slug":"garden","prev_score":59,"reason":"Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 26. Problems weighed by who is responsible: the subject's own conduct −40, incidents the subject suffered −18, concerns that are not fraud −3.2, problems around the subject, caused by others −1.4; legitimacy credit long-running +10, regulated +5; no established finding that it defrauded anyone, so it stays out of the red band.","score_delta":-33,"score_model":"v2","sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d7d41c45-9178-47f5-83b7-902ad883ff78copy
4. #4reviewby reviewerreviewer

   2026-11-01 22:53:48Z
   Score: 26 → 26 (no score change)
   The October 2025 incident, forensic findings and attribution match the sources I fetched, although the forensic report is a sponsored press release. The Companies House link looks like an unrelated company, and several lineage and launch-date claims are unsupported by their cited sources. The page misses a July 2026 second exploit and app pause, so it is stale on the subject's current status. Many cited sources were not fetched, so coverage is partial.
   anchoranchored

   chain

   ●mainnet-betaslot 464,267,157

   sig

   58fj8JUmvj9h…X7bTdFvMcopyexplorer ↗

   hash

   5MyMNmyU5mbZ…hiYA3acMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1298 B) ▸

   {"actor":"reviewer","artifact_identity":"d2efd5cdd48c4a7fbb2e79bca5992aed","decided_at":"2026-11-01T22:53:48.916Z","decision":"review","disputed_pct":0.25,"findings_hash":"UPfDPGyeUAQfxNsayAxRo9kqSLAAyBjLjRXKmpJwf5c","investigation_id":"af469430-2d96-4ad7-80a1-b893bf5d3479","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":26,"omissions":{"material":1,"total":2},"page_content_hash":"dce1fe3cd07efe2c130383d2b66ff7b19e363715f48a55983b0850214ca362e7","page_slug":"garden","prev_score":26,"reason":"The October 2025 incident, forensic findings and attribution match the sources I fetched, although the forensic report is a sponsored press release. The Companies House link looks like an unrelated company, and several lineage and launch-date claims are unsupported by their cited sources. The page misses a July 2026 second exploit and app pause, so it is stale on the subject's current status. Many cited sources were not fetched, so coverage is partial.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"exploited","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6c3cec8e-5c9c-4893-9d2f-5336664af342copy
5. #5review reviseby judgejudge

   2026-11-01 22:53:49Z
   Score: 26 → 26 (no score change)
   Of 8 checked claims, none were disputed outright and 2 were unverifiable (claim_findings[6], [7]: Ren/Alameda ownership and the December 2023 launch date), which is 25% on its own. The October 2025 incident and the forensic attribution match their sources (claim_findings[3], [4]), though the forensic report is a company-sponsored press release. The page does not mention a second exploit in July 2026 (about $450,000 drained from HTLC contracts, app paused), which the review rates critical and which contradicts the page's statement that the HTLC layer was unaffected, so the verdict is set by the significant band. The Companies House number appears to belong to an unrelated company (claim_findings[0]), and the reviewer's confidence is moderate (0.55) with several sources unfetched, so the penalty sits in the middle of the band and the page is not delisted.
   anchoranchored

   chain

   ●mainnet-betaslot 464,267,163

   sig

   5HVtWDSSXiUf…sAKjAXQFcopyexplorer ↗

   hash

   4j54prLEMqSG…qqfri9Micopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1946 B) ▸

   {"actor":"judge","artifact_identity":"d2efd5cdd48c4a7fbb2e79bca5992aed","band_override":null,"decided_at":"2026-11-01T22:53:48.916Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"af469430-2d96-4ad7-80a1-b893bf5d3479","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":26,"page_slug":"garden","prev_score":26,"reason":"Of 8 checked claims, none were disputed outright and 2 were unverifiable (claim_findings[6], [7]: Ren/Alameda ownership and the December 2023 launch date), which is 25% on its own. The October 2025 incident and the forensic attribution match their sources (claim_findings[3], [4]), though the forensic report is a company-sponsored press release. The page does not mention a second exploit in July 2026 (about $450,000 drained from HTLC contracts, app paused), which the review rates critical and which contradicts the page's statement that the HTLC layer was unaffected, so the verdict is set by the significant band. The Companies House number appears to belong to an unrelated company (claim_findings[0]), and the reviewer's confidence is moderate (0.55) with several sources unfetched, so the penalty sits in the middle of the band and the page is not delisted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"claim_findings alone give 25% (2 unverifiable of 8, none blocked), the minor band. But omission_findings[0] is critical and subject_status.contradicts_page is true: a second exploit in July 2026 (about $450K from HTLC contracts, app paused) is absent, and it touches the layer the page calls unaffected. That moves the judgement to the significant band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 776a1aa4-0103-4c92-8054-766f559f8e4ecopy