GMX Attacker Begins Returning $40 Million in Funds After Hack

GMX Attacker Begins Returning $40 Million in Funds After Hack

Decentralized derivatives trading platform GMX made headlines this week after experiencing a large-scale attack. Following a security breach that resulted in the theft of approximately $40 million in cryptocurrency from the GMX V1 protocol on the Arbitrum network, the attacker reportedly accepted the platform's $5 million "white-hat" reward offer and began returning the stolen funds.

GMX was hacked

The attack targeted the GLP liquidity pool on GMX's V1 version on Wednesday. The attacker stole over $40 million in assets across various cryptocurrencies, including USDC, FRAX, WBTC, and WETH. The GMX team quickly halted V1 transactions and GLP production on the Arbitrum and Avalanche networks. However, GMX V2 and the platform's native token were not affected. Following the attack, GMX posted an on-chain message, promising the attacker no legal action and offering a 10% reward, or $5 million, for the return of the funds. This offer was valid for 48 hours after the attack.

According to blockchain security firm PeckShield, the attacker responded to the offer via an on-chain message with the message "ok, funds will be returned later." Subsequently, a total of $10.5 million was returned to the GMX protocol via an address belonging to the attacker, first with 5.5 million FRAX, then with another 5 million FRAX.

News of the return boosts GMX token

Following the attack, the GMX price fell 28 percent to $10.45. However, following positive news about the return of the funds, the token recovered, gaining 15 percent and trading at $13.3 at the time of writing.

GMXUSDT_2025-07-11_12-32-39.png
While the GMX team hasn't yet made an official statement, a post-mortem report released on Thursday detailed the attack. Accordingly, the attacker exploited a re-entrancy vulnerability in the OrderBook contract to manipulate the average short position price of BTC and profit by artificially inflating the GLP token price.

The team stated that it halted operations immediately following the attack, initiated fund tracking in coordination with partners, and confirmed the security of V2. It was announced that GLP production and redemption at Arbitrum would be suspended indefinitely, and any remaining funds would be allocated for compensation. It was also announced that affected users would be allowed to close their positions and that security measures would be implemented for V1 forks.

GMX also announced that additional compensation and mitigation measures would be discussed with the DAO community. Following these developments, transactions on GMX V2 continue securely. Launched on Arbitrum One in 2021, GMX offers users the ability to trade cryptocurrencies like BTC, ETH, and AVAX with up to 100x leverage. The platform has reached a total trading volume of $306 billion to date. According to GMX's website, there are currently over $265 million in open positions and over 715,000 users.

#gmx#gmx price#gmx hack#cryptocurrency hack
Light mode logo
Do you have any questions?Feel free to send us your questions or request a free consultation.
© 2025 All rights reserved