Garden Hack
Reported loss
$11.4M
Solver SSH and Wallet Key Compromise
What happened
On October 30, 2025, an attacker drained approximately $11.4 million belonging to an independent Garden solver. Garden's incident report attributes the loss to compromise of the solver's infrastructure and says protocol contracts and user funds were unaffected.
Technical root cause
The failure involved server access and wallet-key storage. The report establishes the SSH-to-wallet-key path but leaves the initial device compromise unresolved.
How it happened
- The attacker obtained the solver's SSH key from its operating device and gained root access to the server.
- A wallet private key stored in an environment variable enabled withdrawals across multiple blockchains.
- Stolen assets were consolidated, swapped and bridged; some reached Tornado Cash.
- Garden paused user-facing services, offered a 10% bounty and engaged investigators. Its report described subsequent infrastructure hardening and additional independent solvers.
Protocol details
Market Context at Time of Hack
Token Price at Hack
$0.5291
Market Cap at Hack
$6.8M
Reported loss / token market cap
100.00%
Protocol Links
Security review history
- OtterSec View report
Evidence
- report @QuillAudits_AI incident report x.com
- report @De_FiSecurity incident report x.com
- report @CertiKAlert incident report x.com
- report Garden Incident Report — October 30, 2025 garden.finance
- analysis Website reference finance.yahoo.com
- analysis Website reference financefeeds.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
