GMX Hack

What happened

On July 9, 2025, an attacker drained about $42M from the GMX V1 GLP pool on Arbitrum. A reentrancy window in GMX V1's order execution let the attacker open huge WBTC shorts directly on the Vault without updating the tracked average short price. That made GMX's getAum() overstate the pool's value, so GLP the attacker minted could be redeemed for far more ETH, WBTC, USDC and other assets than it cost.

GMX paused V1 trading and GLP minting and redemption on Arbitrum and Avalanche and offered a 10% white-hat bounty. On July 11 the attacker began returning funds and sent back about $37M-$37.5M (including about 9,000 ETH and 10.5M FRAX), keeping roughly $5M as the bounty. GMX V2 was not affected.

How it happened

1. From an attack contract, the attacker opened a position and placed a small decrease order through the V1 OrderBook.
2. A GMX keeper executed the order via PositionManager.executeDecreaseOrder(). Paying out ETH to the attacker contract triggered its receive() callback before leverage was disabled again.
3. Inside the callback, the contract called Vault.increasePosition() directly to open a large WBTC short. The Vault increased globalShortSizes, but ShortsTracker never updated globalShortAveragePrices, so the average price stayed stale.
4. With the stale average, GlpManager.getAum() booked a large unrealized loss on shorts, which inflated AUM and the GLP price.
5. The attacker minted GLP with RewardRouter.mintAndStakeGlp(), repeated the reentrant short step to push AUM higher, then redeemed with RewardRouter.unstakeAndRedeemGlp() for far more pool assets than it had deposited.

Protocol details

Classification Exchange (DEX) / Protocol Logic / Reentrancy

Protocol Type Derivatives

Implementation language Solidity

Protocol links Website @GMX_IO

Market Context at Time of Hack

Token Price at Hack $14.12

Market Cap at Hack $144.0M

Reported loss / token market cap 29.16%

Token Categories

Decentralized Exchange (DEX) Token DeFi Derivatives DEX Avalanche Ecosystem Solana Ecosystem Arbitrum Ecosystem Binance Ecosystem

Protocol Links

GitHub Discord Telegram

Funds Recovery

88.1%

Recovered

$37.0M

Net Loss

$4,998,000

Evidence

• report @GMX_IO incident report x.com
• report Report blog.solidityscan.com
• report @peckshield incident report x.com
• transaction arbiscan.io transaction 0x0318…26ef arbiscan.io
• analysis DeFiLlama defillama.com
• analysis GMX Incident Analysis certik.com
• analysis GMX Exchange Hack Explained sherlock.xyz
• analysis GMX Exploiter Starts to Return Funds After $40M Hack, Token Zooms Higher coindesk.com

Understand the attack patterns

Compare incidents →

Reentrancy