$40 Million Stolen in GMX v1 Exploit
On July 10, a major security incident struck the GMX v1 decentralized exchange, resulting in the loss of approximately $40 million in crypto assets. The exploit targeted a vulnerability in the platform’s GLP token pricing mechanism, allowing the attacker to manipulate values and drain the protocol’s liquidity pool.
The attack affected multiple assets on Arbitrum, the blockchain hosting the first version of GMX. Following the incident, GMX’s team swiftly identified the breach and initiated damage control by communicating publicly and on-chain.
On-Chain Communication Leads to Fund Recovery
Shortly after the attack, the GMX team published an on-chain message directly addressing the exploiter. They acknowledged the hacker’s technical sophistication and proposed a $5 million white hat bounty for the return of at least 90% of the stolen funds.
In a surprising turn of events, the hacker responded on-chain, stating:
“Ok, funds will be returned later.”
Within the hour, the address labeled GMX Exploiter 2 began transferring assets back. As of this writing, over $20 million worth of tokens, including ETH and FRAX, have been returned to the GMX treasury.
$5 Million Bounty Offer Prevents Legal Consequences
The bounty served a dual purpose: it incentivized ethical cooperation and helped the hacker avoid potential criminal liability. The GMX team emphasized that the white hat reward would be freely spendable and came with the offer of proof-of-source documentation, if needed.
They also issued a 48-hour ultimatum, warning that failure to return the assets would result in legal action.
Security Community Reacts
The event was flagged by blockchain security firms, who tracked the attacker’s movements and verified the authenticity of the returned assets. The approach taken by GMX highlights a growing industry trend: offering bug bounties and white hat options as alternatives to criminal prosecution.
Outlook
This case underscores the evolving relationship between blockchain security, ethical hacking, and decentralized finance. By acknowledging the hacker’s skills and creating a path for the safe return of funds, GMX recovered over half of the stolen assets within 24 hours — a rare outcome in the world of DeFi exploits.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.