Garden Finance (solver) key compromise on 2025-10-30 ($11.4M reported)
Key compromise on Ethereum, Solana, BNB Chain, 30 Oct 2025. Reported loss $11.4M. Last verified 4 Nov 2026.
major
Reported loss
$11.4M
as reported by the sources
Recovered
-
nothing reported
Status
Unknown
updated 26 Oct 2026
Date
Ethereum, Solana, BNB Chain
Summary
On 2025-10-30 an attacker who obtained the SSH key of a Garden Finance solver operator gained root access to its server, read a private key stored in an environment variable and drained about $11.4M of the solver's assets across several chains. Garden said no protocol contracts or user funds were affected, and a forensic partner linked the attack to a North Korea-affiliated actor.
- Protocol
- Garden Finance (solver)
- Type
- Key compromise
- Reported loss
- $11,400,000 · as stated: approximately $11.4M source: garden.finance ↗
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | October 30, 2025 | garden.finance ↗ |
| Amount (USD) | approximately $11.4M | garden.finance ↗ |
| Cause | SSH key and private key in an environment variable | garden.finance ↗ |
| Attribution | North Korea-affiliated actor DangerousPassword (per zeroShadow) | garden.finance ↗ |
| Attacker address | 0x98BCc6c34A489CEfdD9DfA8d792CFEFb02Ea2D12 | garden.finance ↗ |
Primary sources
- Garden: Incident report, October 30, 2025 ↗ post-mortem · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram