Road Town, British Virgin Islands, January 29th, 2026, Chainwire
The incident occurred when an attacker gained unauthorized access to the solver’s operating environment and drained approximately $11.4 million in crypto assets belonging to the solver across multiple blockchain networks.
Garden engaged with Ernst & Young (EY) for a forensic study, which confirmed unauthorized access to the solver's infrastructure. EY stated in its forensic findings that the examination of SSH auth logs from the solver server indicated suspicious access from four IP addresses with indicative locations as Japan and China on 30th October 2025.
Garden is a non-custodial protocol in which solvers are architecturally separated from users. As a result of this design, while the solver’s operating environment was compromised, the protocol itself remained unaffected, and no user funds were lost or placed at risk.
In parallel with the forensic review, Garden partnered with zeroShadow, a web3 security and incident response firm, to analyze on-chain activity related to the incident. zeroShadow’s assessment focused on fund movement and laundering behavior observed after the compromise.
According to zeroShadow, the incident originated from a leaked private key on a compromised device. While the exact method of compromise is still unknown, current indicators and on-chain laundering patterns are consistent with those of other attacks attributed to the North Korea-affiliated threat actor DangerousPassword (aka CryptoCore, Sapphire Sleet, UNC1069).
Following detection of the breach, Garden activated its incident response procedures, issued an on-chain whitehat bounty on behalf of the solver, and reported the incident to the local law enforcement authorities. Investigations remain ongoing.
In response to the incident, Garden has taken additional steps to strengthen operational resilience across its solver network. These actions include removing the need for solvers to expose public infrastructure, expanding to multiple independent solver operators to create greater network resilience, and establishing formal security and operational standards for current and future solvers through third-party security partners. Garden has also introduced regular independent VAPT across both protocol and solver infrastructure and appointed a dedicated CISO to oversee ongoing security efforts.
Garden Finance will continue collaborating with external security partners and industry participants to strengthen safeguards, while preserving its permissionless and non-custodial design.
About Garden Finance
Koushik MaturiGarden Finance
