25% of Garden Finance Funds Linked to Stolen Assets, ZachXBT Reveals

Garden Finance suffered an exploit exceeding $10.8 million across multiple blockchain networks, with on-chain sleuth ZachXBT revealing that over 25% of the platform’s historical activity involved funds stolen from the ￰1￱ breach adds scrutiny to a Bitcoin bridge already facing allegations of facilitating North Korean money laundering ￰2￱ address linked to Garden’s team sent an on-chain message to the alleged exploiter offering a 10% white-hat bounty, though the company has not issued a public ￰3￱ freezeable assets were quickly converted by the attacker through addresses 0x98***D12 on EVM chains and WZy4***JCH on Solana.) Thorchain has a larger organic userbase than ￰4￱ raised the swap limit to 10 BTC… — ZachXBT (@zachxbt) October 28, 2025 He criticized Garden for raising its swap limit to 10 BTC earlier this year, which enabled large-scale abuse by illicit entities, while the team remained silent on returning profits from these ￰5￱ Laundering Infrastructure Spans Eight Years According to a detailed investigation on X, Garden Finance operates as the successor to Ren Protocol, founded in 2017 as Republic Protocol in Australia by Taiyang Zhang, Loong Wang, and Jaz ￰6￱ original venture raised $67 million through a $33 million ICO and $34 million from venture capital, later rebranding as Ren Protocol and launching RenVM in ￰7￱ platform facilitated over $13 billion in Bitcoin transactions through bridges during the DeFi ￰8￱ Research acquired Ren in 2021 for $700,000 per quarter, integrating the protocol into Solana’s ecosystem.

However, FTX’s collapse in late 2022 forced Ren’s shutdown, leaving $12 million in user Bitcoin ￰9￱ Protocol and Garden Finance are linked to over $540M laundered ZachXBT calls both “money washing machines” The reality is even worse: 2017: the beginning •founded in Australia as Republic Protocol by Taiyang Zhang, Loong Wang, and Jaz Gulati •promised “private… ￰10￱ — StarPlatinum (@StarPlatinumSOL) October 28, 2025 Former Ren developers, led by Susruth Nadimpalli and Gulati, launched Garden Finance in 2023, claiming to offer “ the next generation of Bitcoin transfers ” through atomic swaps, which enable 30-second BTC ￰11￱ intelligence firm Elliptic reported that Ren processed over $540 million in illicit funds between 2020 and 2025, with the protocol used by the Conti and Ryuk ransomware groups, as well as North Korea’s Lazarus ￰12￱ traced 25 separate hacks that funneled through RenBridge, which served as the preferred path for converting stolen Ethereum into anonymous Bitcoin, ultimately leading Binance to delist REN due to reputational ￰13￱ Korean Operations Dominate Platform Activity Evidence suggests over 75% of Garden’s total volume originated from stolen funds, with $160 million moving through the platform within 48 hours of the $1.4 billion Bybit ￰14￱ earned over $300,000 in fees from these flows while liquidity remained controlled by a single dominant node, contradicting claims of ￰15￱ laundering pattern follows a consistent path, where stolen Ethereum is swapped for Bitcoin via Garden on Arbitrum or Base networks, mixed through Coinbase’s cbBTC, and then chain-hopped into Solana for the final ￰16￱ documented 16 wallets connected to the Bybit hack, executing synchronized six- and seven-figure swaps within minutes, and accused Garden of covering Lazarus Group activity through what he called “ blockchain illiteracy ” and “ willful blindness .” Crypto investigator Tayvano escalated the accusations by alleging that DPRK-based hackers were actively conducting money laundering through Garden.

Chat, it’s DPRK. It’s funds stolen from people, projects, protocols in this ￰17￱ from your ￰18￱ funds stolen to keep the North Korean regime in power & enable them to live their lives of luxury at the expense of North Korean citizens and the world at large. ￰0￱ — Tay (@tayvano_) October 24, 2025 During a heated exchange with Gulati, she stated that the company was undoubtedly aware of DPRK-related discrepancies, yet it did not take user safety or compliance ￰19￱ Korean hackers stole over $1.3 billion across 47 incidents in 2024 and $2.2 billion in the first half of 2025 alone , funding the regime’s weapons program through elaborate money laundering networks.