GarudaDefi

What happened

Between October 20 and 31, 2026, Garuda DeFi suffered multiple security breaches affecting its NFT staking, cross-staking, governance, treasury, frontend and CW20 staking systems on Terra Classic. Attackers migrated staking contracts to malicious code, transferred user assets and rewards, compromised developer wallets to obtain administrative privileges, and injected malicious wallet approval prompts into the protocol's website. The incidents affected 1,114 NFTs and numerous staking tokens, while the total financial loss remains undisclosed. Garuda restored parts of its infrastructure, introduced multisignature administration and began preparing a recovery plan for affected users

Details

Date

Oct 20, 2026

Kind

Hack or exploit

Method

Private Key Compromised

How in

Keys, accounts and infrastructure

Target

DeFi protocol or token

Chains

Terra

Sector

Dexs (DefiLlama protocol id)

What would have stopped it all controls for this way in

• No one machine, person or organisation can move hot funds alone: keys in HSMs or MPC, threshold signers on separate infrastructure.
  Check: List every key that can move funds. For each: where it lives, who and what can reach it. Two keys behind one login count as one.
• Freeze contacts are arranged before they are needed: stablecoin issuers, the large exchanges, SEAL 911.
  Check: A contact sheet with named people, confirmed this quarter; one drill sending a freeze request.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗no figure

Related incidents