Garden Finance Solver Database Compromise — Cross-Chain HTLC Drain

T0 — July 26, 2026, 15:26 UTC: The attacker (0x25b224C05f6cC5e132165C1621dE1A4C3B316999), a code-less externally owned account, redeems 124,785 USDT from the Ethereum USDT HTLC (transaction 0x9d7a961aa340156b7342839e9f6448a26dea9acd38dc7b2638966eb19e29d395) by calling redeem() on the escrow, releasing swap-solver assets directly to itself using fraudulent records inserted into an independent solver's off-chain database. T+6-13 min (15:32-15:39 UTC): BTC-pegged HTLCs are drained across Ethereum, Base, and Arbitrum (cbBTC, WBTC, DLCBTC) via direct redemptions. T+23 min (15:49 UTC): The BSC-side BTCB HTLC is drained. Total direct theft: approximately $440,000-446,000. Blockaid first raises the alarm publicly at 21:30 UTC the same day, describing the incident as an ongoing exploit on Garden's HTLC contracts and noting ~$450K USDT drained so far across Ethereum, Base, Arbitrum, and BSC; a follow-up Blockaid post publishes the exploiter address and an example exploit transaction. Post-theft: the attacker swaps the full loot into ~192 ETH, routes it through the two laundering wallets (0x0cA58018...F410BfbA7e241D and 0x77297e4A...9766A58 / 0x7f24Ccfb...9126A277B), and sends the proceeds to Tornado Cash. Garden Finance takes its application offline as a precaution. July 27, 2026, 02:16 UTC: Garden Finance issues a clarifying statement confirming that neither the protocol nor its HTLC smart contracts were compromised — the breach was isolated to an independent solver's off-chain database, which was manipulated with fraudulent transaction records causing improper fund releases. No user funds were lost or exposed; only assets owned by the affected solver were involved. Garden states it is working with zeroShadow, Quantstamp, and Blockaid on the investigation.