In a favorable turn of events for the cryptocurrency community, the person accountable for the GMX exploit accepted the platform\u2019s reward and restored over $40 million worth of assets that were taken from the project.<\/p>\n
Related Reading<\/span><\/h2>\n<\/p>\nCrypto Hacker Steals $42 Million From GMX<\/h2>\n
On Friday, the recent GMX V1 exploit concluded on a positive note after the individual behind the incident transformed into a white-hat hacker. The perpetual and spot cryptocurrency exchange GMX lost over $40 million on Wednesday when an assailant exploited a flaw in the protocol\u2019s initial version on Arbitrum.<\/p>\n
According to online sources, GMX V1\u2019s vault contract possessed a flaw that permitted the attacker to manipulate the GLP token value<\/a> via the system\u2019s computations.<\/p>\nBlockchain security company SlowMist clarified<\/a> that “The primary cause of this attack originates from GMX v1\u2019s design flaw, wherein short position operations immediately update the global short average prices (globalShortAveragePrices), which directly affects the calculation of Assets Under Management (AUM), thus allowing the manipulation of GLP token pricing.”<\/p>\n\nThrough a reentrancy attack, they effectively established substantial short positions to alter the global average prices, unnaturally inflating GLP prices within a single transaction and profiting from redemption operations.<\/p>\n<\/blockquote>\n
Consequently, approximately $42 million worth of assets, including Legacy Frax Dollar (FRAX), wrapped bitcoin (WBTC), wrapped ETH (WETH), and additional tokens<\/a>, were transferred from the GLP pool to an unidentified wallet.<\/p>\nThe perpetual cryptocurrency exchange suspended<\/a> GMX V1\u2019s trading as well as GLP\u2019s minting and redeeming on both Arbitrum and Avalanche to avert another attack and safeguard users\u2019 funds. Nevertheless, they emphasized that the exploit was confined to GMX\u2019s V1 and its GLP pool. GMX V2, along with its markets and liquidity pools, and the GMX token remained secure.<\/p>\nWhite-Hat Accepts $5 Million Reward<\/h2>\n
In the aftermath of the incident, GMX sent a message on-chain and on X proposing<\/a> a $5 million white-hat bounty to the attacker, asserting that their skills were \u201cclear to anyone examining the exploit transactions.\u201d<\/p>\nThe GMX team stated that returning the funds within the next 48 hours and taking the bounty would permit the hacker to \u201cutilize the funds freely,\u201d rather than facing additional risks to access them. They also pledged not to pursue any legal measures and to assist the exploiter<\/a> in providing proof of the funds’ origin if necessary.<\/p>\nToday, the exploiter replied in an on-chain message, accepting the bounty and initiating the return process. As Lookonchain reported, they first returned $10.49 million worth of FRAX on Friday morning.<\/p>\nGMX exploiter accepts white-hat bounty. Source: Lookonchain on X<\/a><\/figcaption><\/figure>\nMeanwhile, another $32 million worth of assets had been converted into 11,700 ETH, which are now valued at $35 million following the King of Altcoins\u2019 price surge to the $2,990 mark.<\/p>\n
In the subsequent hours, the hacker returned 10,000 ETH, estimated at $30 million, retaining only 1,700 ETH, valued at $5.2 million, as the bounty.<\/p>\n
Related Reading<\/span><\/h2>\n<\/p>\nGMX later acknowledged<\/a> that the funds have now been securely returned and expressed gratitude to the white-hat hacker for their actions, ultimately leading to a favorable outcome for the incident.<\/p>\nFinally, they notified users that \u201ccontributors are working on a proposed distribution plan for presentation to the GMX DAO and will share more details soon.\u201d<\/p>\n![\"crypto,](\"https:\/\/www.newsbtc.com\/wp-content\/uploads\/2025\/07\/GMXUSDT_2025-07-11_15-28-33.png?w=860&resize=860%2C475\")
GMX token trades at $13.24 in the one-week chart. Source: GMXUSDT on TradingView<\/a><\/figcaption><\/figure>\nFeatured Image from Unsplash.com, Chart from TradingView.com<\/p>\n<\/div>\n
Blockchain security company SlowMist clarified<\/a> that “The primary cause of this attack originates from GMX v1\u2019s design flaw, wherein short position operations immediately update the global short average prices (globalShortAveragePrices), which directly affects the calculation of Assets Under Management (AUM), thus allowing the manipulation of GLP token pricing.”<\/p>\n Through a reentrancy attack, they effectively established substantial short positions to alter the global average prices, unnaturally inflating GLP prices within a single transaction and profiting from redemption operations.<\/p>\n<\/blockquote>\n Consequently, approximately $42 million worth of assets, including Legacy Frax Dollar (FRAX), wrapped bitcoin (WBTC), wrapped ETH (WETH), and additional tokens<\/a>, were transferred from the GLP pool to an unidentified wallet.<\/p>\n The perpetual cryptocurrency exchange suspended<\/a> GMX V1\u2019s trading as well as GLP\u2019s minting and redeeming on both Arbitrum and Avalanche to avert another attack and safeguard users\u2019 funds. Nevertheless, they emphasized that the exploit was confined to GMX\u2019s V1 and its GLP pool. GMX V2, along with its markets and liquidity pools, and the GMX token remained secure.<\/p>\n In the aftermath of the incident, GMX sent a message on-chain and on X proposing<\/a> a $5 million white-hat bounty to the attacker, asserting that their skills were \u201cclear to anyone examining the exploit transactions.\u201d<\/p>\n The GMX team stated that returning the funds within the next 48 hours and taking the bounty would permit the hacker to \u201cutilize the funds freely,\u201d rather than facing additional risks to access them. They also pledged not to pursue any legal measures and to assist the exploiter<\/a> in providing proof of the funds’ origin if necessary.<\/p>\n Today, the exploiter replied in an on-chain message, accepting the bounty and initiating the return process. As Lookonchain reported, they first returned $10.49 million worth of FRAX on Friday morning.<\/p>\n Meanwhile, another $32 million worth of assets had been converted into 11,700 ETH, which are now valued at $35 million following the King of Altcoins\u2019 price surge to the $2,990 mark.<\/p>\n In the subsequent hours, the hacker returned 10,000 ETH, estimated at $30 million, retaining only 1,700 ETH, valued at $5.2 million, as the bounty.<\/p>\n GMX later acknowledged<\/a> that the funds have now been securely returned and expressed gratitude to the white-hat hacker for their actions, ultimately leading to a favorable outcome for the incident.<\/p>\n Finally, they notified users that \u201ccontributors are working on a proposed distribution plan for presentation to the GMX DAO and will share more details soon.\u201d<\/p>\n Featured Image from Unsplash.com, Chart from TradingView.com<\/p>\n<\/div>\n\n
White-Hat Accepts $5 Million Reward<\/h2>\n
Related Reading<\/span><\/h2>\n<\/p>\n