Cross-chain liquidity protocol Garden Finance was hit by a targeted attack targeting its Hashed Timelock Contract (HTLC) cross-chain infrastructure. Approximately $450,000 in USDT was drained across four major networks: Ethereum, Base, Arbitrum, and BNB Chain.
Preliminary investigations reveal this was a supply-chain / off-chain database intrusion rather than an onchain smart contract code bug. Attackers breached an independent solver’s off-chain database and injected forged cross-chain swap transaction records. The HTLC smart contracts, relying on the corrupted off-chain solver data, validated the non-existent swaps and mistakenly released real USDT reserves directly to the attacker across all connected chains. Garden Finance temporarily took down its web app to investigate.
The Pipeline to Crypto Theft
This incident underscores how off-chain data dependencies can completely undermine multi-chain smart contract security:
Cross-chain protocols often rely on off-chain "solvers" or "relayers" to track swap states across distinct blockchains. If an attacker breaches the solver's server or database, they can inject arbitrary or forged transaction IDs. The smart contract, assuming the solver's data is authentic, treats the fake payload as a completed deposit on Chain A and releases assets on Chain B.
Because solvers typically manage liquidity across multiple networks simultaneously, a single compromised off-chain database exposes every connected chain. In this case, the attacker triggered simultaneous fraudulent releases on Ethereum, Base, Arbitrum, and BNB Chain—amplifying the total loot without needing to re-engineer exploits for different contract languages.
Security audits focus almost exclusively on smart contract source code. However, if the contract inherently trusts an off-chain oracle, relayer, or database without verifying raw cryptographic zero-knowledge proofs onchain, the smart contract's code can be 100% bug-free yet still be tricked into giving away millions. Off-chain database compromises remain a premier entry point for Web3 drainers.