What happened
On March 25, 2025, Abracadabra's GMX V2 Cauldron markets on Arbitrum were exploited for about $13 million, or roughly 6,260 ETH. The attacker deliberately caused GMX deposits to fail, then used stale collateral accounting to borrow, self-liquidate, and borrow again against collateral that had already been removed. The stolen funds were bridged from Arbitrum to Ethereum; Abracadabra offered a 20% recovery bounty.
How it happened
- The attacker created GMX deposit orders designed to fail, leaving returned assets in the RouterOrder contract.
- Internal accounting continued to count those failed orders as collateral.
- The attacker borrowed MIM, self-liquidated, and extracted real assets from RouterOrder while the accounting still reported collateral.
- They borrowed again against the stale collateral value, passed the end-of-batch solvency check, and repeated the pattern across affected cauldrons.
Protocol details
Classification
Protocol Logic / Exchange (DEX) / Yield Aggregator
Protocol Type
CDP
Implementation language
Solidity
Protocol links
Website
@MIM_Spell
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
