Hacker Transforms Stolen GMX Funds into 11,700 Ether
In a shocking turn of events, the decentralized trading platform GMX experienced a major exploit on July 9, 2025, resulting in the loss of $42 million in various cryptocurrencies. The breach, attributed to a design flaw in GMX V1 by blockchain security firm SlowMist, has left the crypto community on edge.
The exploit, which used a re-entrancy attack, allowed the attacker to manipulate the GLP token price by interfering with the system's calculation of total assets under management. This action artificially inflated the GLP token price and enabled the hacker to profit through redemption.
In response, GMX halted trading and suspended minting and redemption of GLP tokens on both Arbitrum and Avalanche networks to prevent further losses. Users were advised to disable leverage and GLP minting. The exploit only affected GMX V1 and the GLP pool. GMX V2, other markets, liquidity pools, and the GMX token were not impacted.
In a bid to resolve the issue ethically, GMX has offered a white-hat bounty of 10% of the stolen amount to the hacker, urging a swift and ethical resolution. If the stolen funds are returned within 48 hours of the announcement, GMX will not pursue legal action.
The stolen cryptocurrencies were transferred to an unidentified wallet. While there is currently no confirmed public information about the hacker exchanging the stolen funds into Ethereum or other coins, it is plausible that some conversion into Ethereum may have occurred through decentralized exchanges or mixers to obscure the trail.
According to blockchain analytics platform Lookonchain, the bad actor has now exchanged all the stolen assets, except FRAX, into 11,700 ETH. Approximately $32 million of the stolen funds remain on Arbitrum, and a significant portion of the stolen funds, $9.6 million, were bridged to the Ethereum blockchain.
The hacker has changed most of the stolen funds into Ether, and the 11,700 ETH have been sent to four new wallets. GMX users have been advised to disable leverage and update their settings to block further GLP minting.
As the investigation continues, GMX remains committed to managing the fallout and incentivizing the hacker to return funds ethically. The stolen assets remain in unknown wallets, with no confirmed reports yet on their exchange into Ethereum or other cryptocurrencies. The GMX token price suffered a sharp drop following the news, reflecting market concern over the security breach.
This incident underscores the need for continued vigilance and robust security measures in the rapidly evolving world of decentralized finance. As the industry matures, it is crucial that platforms prioritize security to protect users' assets and maintain trust in the system.
[1] GMX Confirms $40 Million Hack on Arbitrum, Offers White-Hat Bounty to Hacker (CoinDesk, July 10, 2025) [2] GMX Hack: A Deep Dive into the Exploit and its Impact (Decrypt, July 11, 2025) [3] GMX Vulnerability Exploited for $40 Million Hack (The Block, July 12, 2025) [4] Aftermath of the GMX Hack: Stolen Assets Remain in Unknown Wallets (CNBC, July 13, 2025)
- The hacker, after the exploit on GMX, converted most of the stolen funds into 11,700 ETH and sent them to four new wallets, according to blockchain analytics.
- Despite the hack, GMX continues to emphasize ethical resolution, offering a white-hat bounty of 10% of the stolen amount to the hacker, urging a swift and ethical resolution.
- The stolen cryptocurrencies, except FRAX, were reportedly exchanged into Ethereum by the unknown hacker, as per the analysis by Lookonchain, though there is yet no confirmed public information about further conversions into other cryptocurrencies.
