Garden Finance Pulls App Offline After $450K HTLC Exploit Hits Four Chains

Garden Finance pulled its application offline on July 27 after blockchain security firm Blockaid detected an attacker draining roughly $450,000 in UUSDT$0.9991▲0.00% from the protocol’s Hash Time-Locked Contract (HTLC) infrastructure. The exploit hit four networks — EETH$1,935.78▲1.50%, Base, Arbitrum, and BBNB$574.65▲0.30% Smart Chain — either simultaneously or in rapid succession, making this a multi-chain event rather than a single-network breach. CoinTelegraph reported the incident, attributing the loss figure to Blockaid’s detection.

All stolen funds were denominated in Tether (USDT), the stablecoin trading at $0.999 with a market cap of $183.94 billion. HTLCs — Hash Time-Locked Contracts — are the smart-contract machinery behind cross-chain atomic swaps and BBTC$64,790.00▲0.50% bridge operations. They lock funds behind a cryptographic hash and a time deadline, letting two parties exchange assets across chains without a trusted intermediary. That trustless design is also the vulnerability: one flaw in the contract logic can cascade across every network where the contract is deployed. One flaw. Four chains drained.

Garden Finance’s immediate response was to kill the app, severing further interaction with the compromised contracts. No official post-mortem has been published, no remediation timeline announced, and no user compensation plan has been confirmed. A Reddit thread titled “Garden Finance Disables App Amid $450K HTLC Exploit” corroborates the shutdown, though it is unverified community discussion — not an official channel — and should be read accordingly.

The attack fits a pattern the sector knows well. Cross-chain bridges and interoperability protocols have been persistent targets this cycle — prior coverage documented two Ethereum bridges drained of $31.7 million and a Triple-A payment gateway losing $9.7 million across a six-chain exploit. HTLC-based systems carry particular exposure because their security model assumes honest participation and robust time-lock enforcement. When the contract logic itself is broken, that trustless guarantee doesn’t just fail — it fails everywhere at once.

The broader market backdrop offered no cushion. The Fear & Greed Index sits at 30/100, firmly in Fear territory, with total crypto market cap at $2,324.09 billion. Sentiment was already fragile before news of another protocol drain started circulating.

What Remains Unknown

Several questions remain open. Whether Blockaid has published a full technical breakdown of the HTLC vulnerability is unconfirmed. Whether the $450,000 figure represents a precise on-chain measurement or an early estimate is unclear. The attacker’s wallet has not been publicly flagged in available reporting. Garden Finance has given no indication of when the app will come back online or whether affected users will be compensated.