Blockchain security firm Blockaid disclosed Thursday that an attacker siphoned approximately $450,000 in USDT from Garden Finance's Hash Time-Locked Contracts (HTLCs) deployed on Ethereum, Base, Arbitrum, and BNB Smart Chain. The exploit prompted Garden Finance to immediately disable its application while the team investigates the vulnerability and assesses the full scope of the breach.

According to Blockaid's analysis, the attacker exploited a flaw in the HTLC implementation that allowed them to claim locked funds without fulfilling the required preimage revelation. HTLCs are designed to facilitate atomic swaps and cross-chain transfers by requiring the recipient to reveal a cryptographic preimage within a specified time window; if the preimage is not revealed, the funds should be refundable to the sender. In this case, the contracts reportedly failed to enforce the time-lock condition properly, enabling the attacker to drain funds across multiple networks simultaneously.

Security researchers noted that the multi-chain nature of the attack suggests the vulnerability existed in shared contract code deployed identically across all four networks, rather than in chain-specific adaptations. This pattern is common among protocols that prioritize deployment speed over per-network auditing. The attacker's ability to execute the same exploit repeatedly across Ethereum, Base, Arbitrum, and BSC within a short window indicates automated tooling, likely scripted to monitor for newly deployed or under-protected HTLC instances.

Blockaid has published the attacker's wallet address and transaction hashes to assist with tracking and potential recovery efforts. The firm also recommended that any protocols using similar HTLC patterns immediately review their timeout enforcement logic, particularly the interaction between block.timestamp checks and the hashtimelock verification functions. Garden Finance has not yet indicated whether it will pursue a bug bounty for the returned funds or engage law enforcement, though the transparency of the on-chain trail may complicate the attacker's ability to cash out through centralized exchanges.

• Blockaid identified a $450,000 USDT exploit targeting Garden Finance's HTLC contracts across Ethereum, Base, Arbitrum, and BNB Smart Chain