Blockchain security company Blockaid issued an alert on July 27, saying an attacker stole about $450k worth of USDT from the HTLC (hashed time-locked contract) in Garden Finance’s cross-chain bridging and atomic swap protocols on Ethereum, Base, Arbitrum, and BNB Smart Chain.
Garden Finance’s HTLC contracts on four chains were exploited
According to Blockaid’s report, the specific scope of impact in this attack is as follows:
Affected blockchains: Ethereum, Base, Arbitrum, BNB Smart Chain
Stolen assets: about $450k USDT
Attack target: HTLC (hashed time-locked contract) — the time-locked custody contract Garden Finance uses to facilitate atomic swaps between Bitcoin and assets on other networks
Vulnerability status (at the time the alert was issued): still ongoing
Unreleased information: Blockaid did not publish specific vulnerability details and did not state whether user funds were affected
Garden Finance’s response: temporarily taking the app offline and issuing a comprehensive investigation statement
Garden Finance took the following actions in response to this incident: after detecting “abnormal activity,” it temporarily took the application offline and launched a comprehensive investigation. Both Garden Finance and Blockaid have received Cointelegraph’s requests for comment (as of the time of reporting, no replies had been received).
Oct. 2025 security incident: resolver operating environment compromised
This incident was not the first time Garden Finance faced security issues. In Oct. 2025, the attacker compromised the operating environment of a Garden Finance resolver and stole about $11.4 million.
At the time, Garden Finance said the earlier leak did not affect its protocol smart contracts and did not endanger users’ funds; this incident’s target differed from the previous one. The earlier attack targeted the resolver operating environment, while this one targeted the HTLC contracts.
## FAQ
How much did Blockaid report that Garden Finance lost, and which blockchains were involved?
According to Blockaid’s alert, the attacker stole about $450k worth of USDT from Garden Finance’s HTLC contracts on four chains—Ethereum, Base, Arbitrum, and BNB Smart Chain. Blockaid said that at the time the alert was issued, the vulnerability was still ongoing, but it did not disclose specific vulnerability details.
What is HTLC, and what role does it play in Garden Finance?
HTLC (hashed time-locked contract) is a time-locked custody contract. Garden Finance uses it to facilitate atomic swaps between Bitcoin and assets on other networks; if the swap is not completed within a specific time window, the funds are automatically returned.
Has Garden Finance previously faced similar security incidents?
Yes. In Oct. 2025, the attacker compromised the operating environment of a Garden Finance resolver and stole about $11.4 million. At the time, Garden Finance said the leak did not affect its protocol contracts or user funds. The July 2026 incident targeted the HTLC contract, which differs from the previous one.
