Between October 20 and 31, 2026, Garuda DeFi suffered multiple security breaches affecting its NFT staking, cross-staking, governance, treasury, frontend and CW20 staking systems on Terra Classic. Attackers migrated staking contracts to malicious code, transferred user assets and rewards, compromised developer wallets to obtain administrative privileges, and injected malicious wallet approval prompts into the protocol's website. The incidents affected 1,114 NFTs and numerous staking tokens, while the total financial loss remains undisclosed. Garuda restored parts of its infrastructure, introduced multisignature administration and began preparing a recovery plan for affected users