Share this article
GMX Exploiter Return $40M Days After Hack, Token Zooms Higher
Attackers earlier this week exploited a re-entrancy flaw in the OrderBook contract, allowing the attacker to manipulate short positions on BTC, inflate GLP’s valuation, and redeem it for outsized profits.
Updated Jul 11, 2025, 4:46 p.m. Published Jul 11, 2025, 10:41 a.m.
What to know:
- The attacker who stole over $40 million from GMX's V1 contracts has begun returning the funds, indicating acceptance of a $5 million white-hat bounty.
- Over $10.5 million in FRAX was first returned to GMX's deployer wallet, with the remaining funds sent shortly afterward.
- The breach exploited a re-entrancy flaw in GMX's OrderBook contract, prompting GMX to halt V1 trading and minting on Arbitrum and Avalanche.
The attacker who drained over $40 million from GMX’s V1 contracts earlier this week has started returning funds, suggesting they’ve accepted the project’s $5 million white-hat bounty.
The first signs came Friday via an on-chain message: “ok, funds will be returned later.”
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
Hours later, over $10.5 million in FRAX was sent back to GMX’s deployer wallet. Security firm PeckShield flagged the returns, which appear to be just the start, with more funds expected to follow.
GMX is now trading at $13.15 having risen by 13% over the past 24 hours.
Loading...
Later on, over $40 million in various tokens were returned to the GMX Security Committee MultiSig address, Lookonchain noted.
Loading...
The breach, one of the largest DeFi exploits of the year, targeted GMX’s GLP pool on Arbitrum. It exploited a re-entrancy flaw in the OrderBook contract, allowing the attacker to manipulate short positions on BTC, inflate GLP’s valuation, and redeem it for outsized profits across USDC, WBTC, WETH, and FRAX.
Reentrancy is a common bug that allows exploiters to trick a smart contract by repeatedly calling a protocol to steal assets. A call authorizes the smart contract address to interact with a user’s wallet address.
GMX responded by halting V1 trading and minting across both Arbitrum and Avalanche. A bug bounty worth more than 10% of the stolen funds was offered, with a promise of no legal pursuit if the full amount was returned within 48 hours (which the hacker seems to have adhered to as of European morning hours Friday).
More For You
What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Japan’s Higher Rates Puts Bitcoin in the Crosshairs of a Yen Carry Unwind
A stronger yen typically coincides with de-risking across macro portfolios, and that dynamic could tighten liquidity conditions that recently helped bitcoin rebound from November’s lows.
What to know:
- The Bank of Japan is expected to raise interest rates to 0.75% at its December meeting, the highest since 1995, affecting global markets including cryptocurrencies.
- A stronger yen could lead to de-risking in macro portfolios, impacting liquidity conditions that have supported bitcoin's recent recovery.
- Governor Kazuo Ueda indicated a high probability of a rate hike, with officials prepared for further tightening if their economic outlook supports it.
Top Stories
