GMX Hack

On July 9, 2025, GMX v1 was exploited for approximately $42 million due to a vulnerability that allowed a malicious contract to manipulate internal accounting and withdraw more funds than it should have. The attack affected the GLP pool on Arbitrum; other GMX deployments were not impacted. GMX has paused relevant operations and offered a bounty for the return of funds.

The attacker abused PositionManager.executeDecreaseOrder() by using a smart contract as the _account parameter, which triggered ETH refunds with no gas limit, enabling reentrancy. Within the callback, the attacker opened large short positions, causing getAum() in GlpManager.sol to register unrealized losses and inflate the protocol’s Assets Under Management (AUM). This inflated AUM was then used to redeem GLP tokens at an overvalued rate, draining ETH, USDC, and WBTC from the vault.

This loop was executed multiple times, resulting in ~$42M in total losses. The GMX team confirmed the issue was limited to v1’s GLP vault on Arbitrum, paused related functions, and initiated a bounty program for fund recovery.

Exploit tx:

https://arbiscan.io/tx/0x03182d3f…2626ef