Do you know that even in a Web3 ecosystem where smart contracts are rigorously audited, battle-tested, and mathematically verified, off-chain operational infrastructure remains a persistent target of vulnerability for sophisticated attackers?
Now, Cross-chain liquidity bridges and atomic swap protocols, Garden Finance found itself in the spotlight over the weekend when security monitors flagged unusual, high-volume draining activities across its network. The protocol acted swiftly, taking its main application interface offline and isolating system operations to mitigate potential threats.
Initially, on-chain monitoring firms reported a major protocol exploit. In reality, the attack only hit an off-chain database, so smart contracts were not affected, and customer funds remained safe.
Anatomy of the Incident: How the Off-Chain Attack Unfolded
The incident started when Blockaid, a blockchain security platform, noticed unusual automated withdrawals from Garden Finance’s Hash Time-Locked Contracts (HTLCs). These suspicious transactions appeared across several major networks, including Ethereum, Base, Arbitrum, and BNB Smart Chain.
Early alerts described the event as a smart contract exploit involving about $450,000 in USDT.
However, now detailed technical investigations conducted by Garden’s engineering team quickly clarified the exact mechanics of the intrusion:
- Off-Chain Database Compromise: The attacker did not access Garden’s core protocol or smart contracts. Instead, they targeted the external off-chain database of one independent solver in the network.
- Injected Fake Swap Records: After getting into the solver’s database, the attacker added fake transaction logs and swap requests.
- Automated Capital Release: Manipulated off-chain data led the automated solver node to believe that Bitcoin funding was confirmed. As a result, it sent $450,000 of its own USDT to the attacker across several EVM chains.
- Precautionary Isolation: When Garden Finance found the problem, it took the front-end app offline and paused gateway services. This gave the team time to check all active solvers and stop any more unauthorized actions.
Zero User Losses: The Power of Segregated Architecture
The most important detail is that no user funds were lost, stolen, or put at risk. Garden Finance uses atomic swaps with non-custodial Hash Time-Locked Contracts, so user assets are never stored in a central treasury. Solvers work independently with their own funds. When the database was breached, only the compromised solver’s funds were stolen, not those of retail or institutional users.s.
In an era where operational collapses and security failures frequently send shockwaves through the market, much like the industry-defining moment when 11 years, zero hacks, and a sudden end marked the final chapter of Arthur Hayes’ BitMEX Garden, the underlying architecture successfully passed the ultimate real-world stress test by safeguarding user capital during a breach.
Recurring Threats and the Need for Stronger Off-Chain Security
This is not the first time off-chain solver infrastructure has been attacked in the cross-chain space. A similar breach happened in October 2025, when an attacker broke into a solver’s environment and stole about $11.4 million. In both cases, the main smart contracts were not affected, and user balances stayed safe.
These repeated attacks show a big challenge for the industry. As smart contracts get better at stopping on-chain exploits, attackers are now focusing on off-chain servers, API endpoints, and databases that provided data to these systems.
Forensic Recovery and Next Steps
While Garden Finance is actively working alongside top-tier blockchain security and forensic specialists, including zeroShadow, Quantstamp, and Blockaid, to trace the movement of the stolen USDT across the blockchain, flag receiving addresses, and coordinate recovery efforts with law enforcement agencies.
Backed by its recent SOC 2 Type II compliance attestation, Garden Finance emphasized that its immediate operational priority is completing comprehensive security checks on all independent solver nodes. The protocol expects to bring its web application back online and restore full atomic swap functionality as soon as infrastructure verification is complete.
​
