Briefing
A critical security incident on the Garden Finance cross-chain bridge resulted in the unauthorized siphoning of multi-chain liquidity, immediately compromising user assets across multiple ecosystems. The core consequence was a direct depletion of liquidity pools containing WBTC, USDC, and USDT, leading to an operational halt and a loss of confidence in the platform’s solvency model. This breach, which the team attributed to a third-party solver compromise, successfully drained over $10.8 million in digital assets.
Context
The protocol’s architecture, which utilized off-chain “solvers” to facilitate cross-chain atomic swaps, inherently expanded the attack surface beyond the audited smart contracts. This hybrid CeDeFi model introduced an opaque dependency on external Web2 infrastructure, which was already under scrutiny for allegedly processing a significant volume of illicit funds from prior major exploits. The risk was compounded by the centralization of the solver function, creating a high-value target for a sophisticated attack.
Analysis
The attacker exploited a vulnerability within the third-party solver’s operational infrastructure, gaining unauthorized control over the mechanism responsible for executing cross-chain transactions. This compromise allowed the attacker to bypass the protocol’s access controls and trigger internal withdrawal operations, effectively impersonating the authorized entity. The attacker then executed a series of coordinated, multi-chain transactions to drain liquidity pools on Arbitrum, Ethereum, and Solana, consolidating the stolen WBTC, USDC, and USDT. Forensic analysis confirms the attacker laundered $6.65 million of the stolen assets via Tornado Cash.
Parameters
- Total Funds Drained → $10.8 Million (The total amount of digital assets siphoned from multi-chain liquidity pools.)
- Chains Affected → Arbitrum, Ethereum, Solana (The primary blockchain networks where liquidity was compromised.)
- Funds Laundered → $6.65 Million (The value of stolen assets transferred to the Tornado Cash privacy mixer.)
- Attack Vector Type → Third-Party Solver Compromise (The root cause, focusing on the external component failure.)
Outlook
Immediate mitigation requires all protocols relying on similar off-chain, centralized components to conduct an emergency audit of their third-party solver security and key management procedures. The incident establishes a clear contagion risk for other cross-chain bridges utilizing opaque, non-EVM solver architectures, demanding a shift toward fully on-chain verification mechanisms. New security best practices will likely mandate the isolation of liquidity management from external Web2 infrastructure to prevent single points of failure.
Verdict
This multi-chain compromise confirms that the systemic risk of hybrid DeFi protocols is directly proportional to the weakest link in their centralized, off-chain operational dependencies.
