Investigation Reveals 25% of Garden Finance Funds Connected to Stolen Assets

25% of Garden Finance Funds Linked to Stolen Assets, ZachXBT Reveals

Garden Finance recently suffered an exploit exceeding $10.8 million across various blockchain networks. An investigation by ZachXBT uncovered that more than 25% of the platform's historical funds were linked to theft. The incident raises concerns about the integrity of the Bitcoin bridge, which is already under scrutiny for facilitating North Korean money laundering activities. While an on-chain message from the Garden team offered a white-hat bounty to the alleged exploiter, no formal public statements have been made.

Key Takeaways

Exploit Details: Garden Finance lost over $10.8 million due to a security breach, with 25% of funds linked to theft.
Concerns for Bitcoin Bridge: The breach has increased scrutiny on a Bitcoin bridge accused of aiding North Korean money laundering.
Accusations Against Garden Finance: ZachXBT criticized the platform for profiting from illicit sources without addressing victim concerns.
Historical Context: Garden Finance builds upon a legacy of the Ren Protocol, which previously processed billions in transactions but faced issues after the FTX collapse.
North Korean Links: Evidence suggests over 75% of transactions on Garden may involve stolen funds, with connections to multiple high-profile hacks, including the Bybit incident.

Overview of the Exploit and Its Consequences

Garden Finance suffered a significant breach, losing over $10.8 million across several blockchain networks. According to blockchain investigator ZachXBT, more than 25% of the platform's past transactions involved funds that had been stolen. This incident has intensified scrutiny on a Bitcoin bridge already accused of being involved in North Korean money laundering operations.

As part of the investigation, an address linked to Garden’s team attempted to reach out to the alleged hacker by offering a 10% bounty for returning the stolen assets. However, there has been no public comment from the company regarding this exploit. The hacker quickly moved all freezeable assets using addresses 0x98D12 on EVM chains and WZy4JCH on Solana.

Prior Concerns About Security Practices

Days prior to the exploit, ZachXBT criticized Garden Finance for neglecting victims seeking refunds after they processed funds from significant hacks, such as the Bybit exploit and the Swissborg incident. The investigator noted that over 25% of Garden’s total volume stemmed from questionable sources, with the platform reportedly earning six-figure profits from such transactions between April and July 2025.

ZachXBT specifically targeted Garden co-founder Jaz Gulati, who had been celebrating the platform’s growth since its launch two years ago as a continuation of Ren Protocol. In a remark, ZachXBT said, “I sincerely hope a government puts your team in prison with Diddy next cycle for ignoring victims like Bybit after >25% funds bridged are stolen funds.“

When asked about his views on permissionless protocols, ZachXBT differentiated Garden from Tornado Cash, stating that only Tornado Cash had successfully passed his decentralization assessment, as it continued operating after various sanctions and arrests. He criticized Garden for increasing its swap limit to 10 BTC earlier this year, which facilitated large-scale misuse by illicit organizations while the company remained quiet on returning profits from those transactions.

Historical Background of Money Laundering Operations

A comprehensive investigation highlighted that Garden Finance is seen as a successor to Ren Protocol, which was established in 2017 in Australia by Taiyang Zhang, Loong Wang, and Jaz Gulati. Initially branded as Republic Protocol, it raised $67 million through ICO and venture capital investments, later rebranding and launching RenVM in 2020.

During the DeFi boom, the platform facilitated over $13 billion in Bitcoin transactions via bridges. In 2021, Alameda Research acquired Ren for $700,000 per quarter, incorporating the protocol into Solana’s ecosystem. However, the collapse of FTX in late 2022 led to Ren’s closure, resulting in $12 million in stranded Bitcoin for users.

Developers from the original Ren team, including Susruth Nadimpalli and Gulati, founded Garden Finance in 2023, claiming to provide “the next generation of Bitcoin transfers” through atomic swaps, enabling 30-second BTC transactions. Blockchain intelligence firm Elliptic reported that Ren facilitated over $540 million in illicit funds from 2020 to 2025, with its protocol utilized by ransomware groups like Conti and Ryuk, as well as North Korea’s Lazarus Group.

ZachXBT traced 25 separate hacks funneled through RenBridge, which became the preferred method for converting stolen Ethereum into untraceable Bitcoin; these events ultimately prompted Binance to delist REN due to reputational concerns.

Allegations of North Korean Operations

Evidence indicates that over 75% of Garden’s total transactions derived from stolen assets, with $160 million processed through the platform within 48 hours of the $1.4 billion Bybit hack. Garden reportedly earned over $300,000 in fees from these transactions while liquidity was managed by a single dominant node, contradicting claims of decentralization.

The laundering method follows a consistent trajectory in which stolen Ethereum is exchanged for Bitcoin via Garden on Arbitrum or Base networks, mixed through Coinbase’s cbBTC, and subsequently moved to Solana for final transactions. ZachXBT identified 16 wallets linked to the Bybit hack, performing synchronized six- and seven-figure exchanges in rapid succession. He accused Garden of facilitating Lazarus Group’s activities due to what he termed “blockchain illiteracy” and “willful blindness.”

Crypto investigator Tayvano has elevated these accusations, asserting that hackers from North Korea were actively using Garden for money laundering. In a contentious exchange with Gulati, she indicated that the company was likely aware of discrepancies related to North Korean activities but did not prioritize user safety or compliance.

North Korean hackers are reported to have stolen over $1.3 billion across 47 incidents in 2024 and $2.2 billion in the first half of 2025, funding the regime’s weapons development through complex money laundering networks.