Garden Finance takes app offline after independent solver database compromise

Share Link copied Garden Finance has temporarily taken its application offline after an attacker compromised the off-chain database of an independent solver, leading to the loss of solver-owned digital assets while leaving protocol contracts and user funds unaffected. Summary Garden Finance temporarily took its app offline after an independent solver’s off chain database was compromised, resulting in the loss of solver owned funds. The protocol said its smart contracts and user funds were not affected because the attack was limited to one solver’s infrastructure.

Blockaid estimated the attacker drained about $450,000 in USDT from HTLC contracts across multiple blockchains before the incident was contained. Garden has engaged zeroShadow, Quantstamp and Blockaid to trace the stolen assets and support recovery efforts. The incident follows a similar 2025 solver breach and comes as crypto security researchers continue tracking multiple exploits across the sector.

Blockchain security firm Blockaid reported on Sunday that an attacker drained about $450,000 in USDT from Garden Finance’s hash time-locked contracts (HTLCs) deployed across Ethereum, Base, Arbitrum and BNB Smart Chain, describing the exploit as active while publishing wallet addresses linked to the attacker and the affected contracts. 🚨 Blockaid detected an ongoing exploit on @gardenfi HTLC.~$450k USDT drained so far on Eth, Base, Arb and BSC.

More details in 🧵— Blockaid (@blockaid_) July 26, 2026 Garden Finance later told Cointelegraph that the protocol itself had not been breached. Instead, the company said the incident originated from the off-chain infrastructure of an independent solver, where an attacker gained access to the solver’s database and inserted fraudulent transaction records that triggered releases of funds for swaps that had never been funded by the corresponding counterparty. As a precaution, Garden temporarily took its application offline while engineers isolated the affected infrastructure and reviewed the incident.

The protocol said no user funds were lost or exposed because only assets owned by the affected solver were involved. The company added that it is still verifying the total amount lost, along with the exact assets and blockchain networks affected by the attack. Off-chain solver targeted rather than protocol While Blockaid initially associated the incident with Garden’s HTLC infrastructure, the protocol said its smart contracts continued operating as designed and were not exploited.

Garden explained that HTLCs serve as escrow contracts that enable atomic swaps between Bitcoin and assets on other blockchains by locking funds until predefined conditions are met or time limits expire. According to the company, those contracts remained secure throughout the incident. Instead, Garden attributed the loss to manipulated records inside the compromised off-chain database used by one of its independent solvers.

The fraudulent entries caused the solver to release funds for swaps despite the corresponding deposits never being completed. According to Garden, the incident remained isolated to a single participant within its decentralized network of independent solvers rather than affecting the broader protocol. You might also like: Triple A says it can meet all liabilities after treasury wallet exploit “Garden’s protocol and HTLC smart contracts were not compromised, and no user funds were lost or at risk,” the company told Cointelegraph while emphasizing that only solver-owned assets were affected.

The protocol also noted that it does not control the infrastructure operated by independent solvers, which execute swaps within the network. Recovery efforts underway with security firms Garden said it has engaged blockchain security and incident response firms zeroShadow, Quantstamp and Blockaid to trace the stolen assets and support recovery efforts. Alongside those investigations, the company said it expects to restore normal services after completing additional security reviews, although it has not provided a timeline for bringing the application fully back online.

we identified unusual activity on garden today and are looking into it.the app is temporarily offline while we complete a full investigation.we'll share updates as soon as we have more information.

— Garden 🌸 (@gardenfi) July 26, 2026 The protocol added that its immediate priorities include securing the affected infrastructure, tracing the compromised solver’s assets and ensuring every required security check has been completed before services resume. Garden also pointed to its recently completed SOC 2 Type II attestation, saying the certification demonstrates ongoing investment in operational controls and security processes even though the latest incident originated from infrastructure operated by an independent network participant. The latest disclosure comes only days after Singapore-based stablecoin payments company Triple-A confirmed unauthorized access to company treasury