Garden Finance Hit by $450K Cross-Chain Exploit Targeting HTLC Smart Contracts

The breach, still ongoing as of detection, targets the protocol's Hash Time Locked Contracts and marks the second major incident for the cross-chain bridge in under a year, sharpening scrutiny on the structural weaknesses of HTLC-based atomic swap architectures.

The mechanism under fire

Garden Finance relies on HTLCs — conditional escrow boxes governed by hashlocks and timelocks — to coordinate trustless swaps between disparate chains. In practice, two counterparties lock assets on separate networks; the swap finalizes only if both sides present cryptographic proofs before the timelock expires. The atomicity guarantee is what makes the design appealing for Bitcoin-to-EVM liquidity routing.

According to Blockaid's read of the incident, the attacker was able to extract USDT directly from these HTLC contracts across multiple chains in parallel. That simultaneity is the key technical signal: a single-chain bug would manifest as localized drain on one deployment. The synchronized, cross-chain pattern instead points to a flaw in shared contract logic or in how Garden Finance ports its settlement code across EVM environments — a class of vulnerability that audits from Trail of Bits, OtterSec, and Zellic evidently did not surface.

A layered attack surface

The current exploit reads fundamentally differently from Garden Finance's late-2025 breach, which was attributed to a compromised solver — an off-chain actor responsible for executing the swap legs — and resulted in losses between $10.8 million and $11 million. At the time, Garden Finance maintained that user funds were unaffected.

This time the contracts themselves appear to be the entry point. The dollar figure is smaller, but the qualitative shift is what practitioners should note: a protocol hit through both its off-chain execution layer and its on-chain settlement primitives carries a fundamentally broader attack surface than either incident alone would suggest. The open question is whether this stems from a logic flaw in the HTLC implementation, a deployment-time inconsistency between chains, or a shared dependency — an oracle, a signer set, or a cross-chain message verification path — that was overlooked in the audit scope.

What to monitor

Blockaid flagged the incident as still active at detection, meaning the vulnerability could remain exploitable until contracts are paused or upgraded. Any party with funds routed through Garden Finance should treat the protocol as compromised pending a published post-mortem and a clean redeployment. Beyond the immediate response, the episode feeds a broader pattern: Across Protocol disclosed a separate ~$4.5 million loss tied to a relay-software bug on Solana — user funds unaffected, patched within five hours — while AFX has scheduled a goodwill plan for August 3 following a $24.15 million bridge hack traced to a supply-chain compromise. The signal for the DeFi security community is not that bridges are uniquely fragile in isolation, but that the audit perimeter must extend across every layer a swap touches — on-chain contracts, off-chain relayers, solver infrastructure, and the deployment pipeline itself.