Garden Finance Faces $10M DeFi Bridge Exploit Across Chains
- Garden Finance exploits drains over $10 million across multiple blockchain networks.
- ZachXBT disputes Garden’s claim, citing on-chain evidence of a broader protocol breach.
- Over 25% of Garden Finance activity is linked to funds from prior major crypto hacks.
Garden Finance, a cross-chain protocol that enables transfers between Bitcoin and Ethereum, has temporarily suspended its operations following a reported security breach. The team stated that the impact is related to a single “solver,” which facilitates cross-chain swaps, and assured that user funds and the protocol remain secure.
However, on-chain data and independent blockchain researchers indicate that attackers drained between $5.5 million and $10.8 million in digital assets from the platform across several blockchain networks. Several reports identified the attacker’s wallets as 0x98BCc6c34A489CEfdD9DfA8d792CFEFb02Ea2D12 on Ethereum and WZy4xxpqktWa1b6MPMRiWsD487CT8mDcapB6GufBJCH on Solana.
On-chain evidence, bounty offer, and asset movements
An official on-chain message from a wallet linked to Garden Finance acknowledged the compromise across multiple networks, including Arbitrum. The Garden protocol team wrote in that message,
We are aware that our systems have been compromised across multiple blockchains, including but not limited to Arbitrum, and assets have been taken from us. In the spirit of resolution, we are offering a 10% reward for your assistance in returning the funds and helping us identify and fix the vulnerability.
ZachXBT and other blockchain analysts reported that the attacker quickly moved the stolen tokens, making recovery more complicated. According to early reports, the hacker routed trades through MetaMask’s aggregator, which is fast but costly, and quickly off-ramped assets. Swapped tokens included Lombard-locked BTC, WBTC, wrapped ETH, cbBTC, and SEED, Garden Protocol’s native token.
However, the researchers observed strong price movements in related tokens during the breach. SEED, the native token of Garden Finance, lost more than 60 percent of its value in minutes due to a large-scale sale by the exploiter via Uniswap.
Background and Broader Concerns in DeFi Security
In addition, Garden Finance was established in 2023 as the successor to Ren Protocol, which was launched in 2017 as Republic Protocol. After FTX’s collapse and Ren’s suspension, it continued to provide decentralized, cross-chain liquidity.
Despite its growth, Garden has faced scrutiny for its compliance and transaction monitoring practices. Blockchain researchers have also said its infrastructure was used to transfer illicit funds, including possible links to North Korean cyber groups.
The incident revived scrutiny of Garden Finance’s historical flows. ZachXBT previously alleged that a significant share of activity moving through Garden earlier this year came from stolen funds associated with large-scale hacks.
In mid-October, it was estimated that more than 75% of the volume from April to July originated from illicit sources, and it was stated that the project had collected substantial fees on those transfers.
ZachXBT’s investigation further linked Garden Finance to past money-laundering concerns. He stated that approximately 25 percent of the total transaction volume of the protocol involved funds from previous exploits, such as the Bybit and Swissborg hacks. The researcher claimed that Garden earned six-figure profits in fees from these transactions but did not help the victims or return the proceeds from the stolen assets.
The Garden Finance exploit highlights the presence of weaknesses in cross-chain bridge technology, which these massive theft attacks in the decentralized finance sector have targeted. Security experts advise users not to transact with the platform’s smart contracts until the team has provided a full post-mortem report and can resume verified operations.
Additionally, Garden Finance is still examining the breach and has not released any new public statements beyond the initial one. Blockchain tracking shows that multiple associated wallets continue to hold stolen assets, and efforts to recover or negotiate are ongoing.
