Markets
Share this article

GMX Exploiter Return $40M Days After Hack, Token Zooms Higher

Attackers earlier this week exploited a re-entrancy flaw in the OrderBook contract, allowing the attacker to manipulate short positions on BTC, inflate GLP’s valuation, and redeem it for outsized profits.

By Shaurya Malwa|Edited by Oliver Knight
Updated Jul 11, 2025, 4:46 p.m. Published Jul 11, 2025, 10:41 a.m. 2 min read
Hacker working on two laptops (Azamat E/Unsplash)

What to know:

  • The attacker who stole over $40 million from GMX's V1 contracts has begun returning the funds, indicating acceptance of a $5 million white-hat bounty.
  • Over $10.5 million in FRAX was first returned to GMX's deployer wallet, with the remaining funds sent shortly afterward.
  • The breach exploited a re-entrancy flaw in GMX's OrderBook contract, prompting GMX to halt V1 trading and minting on Arbitrum and Avalanche.

The attacker who drained over $40 million from GMX’s V1 contracts earlier this week has started returning funds, suggesting they’ve accepted the project’s $5 million white-hat bounty.

The first signs came Friday via an on-chain message: “ok, funds will be returned later.”

Hours later, over $10.5 million in FRAX was sent back to GMX’s deployer wallet. Security firm PeckShield flagged the returns, which appear to be just the start, with more funds expected to follow.

GMX is now trading at $13.15 having risen by 13% over the past 24 hours.

Later on, over $40 million in various tokens were returned to the GMX Security Committee MultiSig address, Lookonchain noted.

The breach, one of the largest DeFi exploits of the year, targeted GMX’s GLP pool on Arbitrum. It exploited a re-entrancy flaw in the OrderBook contract, allowing the attacker to manipulate short positions on BTC, inflate GLP’s valuation, and redeem it for outsized profits across USDC, WBTC, WETH, and FRAX.

Reentrancy is a common bug that allows exploiters to trick a smart contract by repeatedly calling a protocol to steal assets. A call authorizes the smart contract address to interact with a user’s wallet address.

GMX responded by halting V1 trading and minting across both Arbitrum and Avalanche. A bug bounty worth more than 10% of the stolen funds was offered, with a promise of no legal pursuit if the full amount was returned within 48 hours (which the hacker seems to have adhered to as of European morning hours Friday).

TradingMarkets

More For You

Elon Musk's SpaceX held 18,712 bitcoin at fair value of $1.29 billion at end of Q1, IPO filing shows

By Helene Braun, AI Boost|Edited by Aoyon Ashraf, Stephen Alpher, Nikhilesh De
18 minutes ago
(Kirsty Wigglesworth - WPA Pool/Getty Images)

The rocket and satellite company is looking to go public at a valuation of more than $1.5 trillion.

What to know:

  • SpaceX has filed its S-1 with the Securities and Exchange Commission, confirming plans for an initial public offering expected next month that could be the largest in history.
  • The company is reportedly seeking a valuation of more than $1.5 trillion, which would place it among the 10 most valuable publicly...
Read full story