GardenFi HTLC Exploit Drains $450K Across Four Blockchains, Blockaid Reports
Security firm Blockaid has flagged an active exploit targeting GardenFi’s Hashed Timelock Contract (HTLC) system, with approximately $450,000 in USDT drained so far across Ethereum, Base, Arbitrum, and BNB Chain. The incident, first reported on July 26, 2026, highlights ongoing vulnerabilities in cross-chain decentralized finance protocols.
Blockaid Detects Multi-Chain Drain
Blockaid’s alert described the exploit as ongoing, meaning the final loss figure may still change as investigators trace wallet activity. The attacker moved across four major blockchain networks, indicating a coordinated multi-chain approach rather than a single-chain incident. HTLC contracts are commonly used in cross-chain DeFi for conditional transactions, but their complexity can introduce security gaps.
Also read: Tokenized Pre-IPO Equity Market Surges in H1 2026: $4.7 Billion in New Issuance
Blockaid stated on X: “Blockaid detected an ongoing exploit on @gardenfi HTLC. ~$450k USDT drained so far on Eth, Base, Arb and BSC.” The firm has not yet released a full technical breakdown of the exploit vector.
Cross-Chain Risks in Focus
The exploit underscores a persistent challenge in DeFi security: cross-chain protocols must secure not just individual smart contracts but also the bridges and relay mechanisms that connect them. A vulnerability in one network’s implementation can cascade across others. In this case, the attacker exploited the HTLC component to drain stablecoin liquidity from multiple chains simultaneously.
Also read: BitMine Adds 7,430 ETH to Reserves, Now Holds 5.78 Million Ether
Stablecoin pools are frequent targets because they hold high liquidity and are often used as base pairs for trading and lending. The $450,000 figure, while not catastrophic by DeFi standards, represents a significant loss for a protocol of GardenFi’s scale and adds to a growing list of cross-chain exploits in 2026.
Earlier this month, Lien Finance suffered a $542,000 exploit through a smart contract flaw, and similar incidents have prompted calls for better real-time monitoring and emergency pause mechanisms across multi-chain protocols.
What GardenFi Users Should Watch For
As of publication, GardenFi has not released an official statement or recovery plan. Users should monitor official channels for updates on whether contracts have been paused, which addresses are affected, and whether any recovery or compensation process is underway.
Security analysts recommend that users revoke any token approvals linked to GardenFi contracts until the protocol confirms it is safe to interact with. Tools like Etherscan’s token approval checker or Revoke.cash can help identify and revoke suspicious approvals.
The incident also raises questions about the adequacy of security audits for cross-chain DeFi protocols. Blockaid’s real-time detection capability proved valuable in alerting the community, but detection alone does not stop an active exploit. Protocols increasingly need automated pause triggers and rapid response teams to limit damage.
This is a developing story. Further details from GardenFi and Blockaid may clarify the full scope of the exploit and any remediation steps.
