Incident Overview
On July 9, 2025, GMX v1 was exploited for approximately $42 million due to a vulnerability that allowed a malicious contract to manipulate internal accounting and withdraw more funds than it should have. The attack affected the GLP pool on Arbitrum; other GMX deployments were not impacted. GMX has paused relevant operations and offered a bounty for the return of funds.
The attacker abused PositionManager.executeDecreaseOrder() by using a smart contract as the _account parameter, which triggered ETH refunds with no gas limit, enabling reentrancy. Within the callback, the attacker opened large short positions, causing getAum() in GlpManager.sol to register unrealized losses and inflate the protocol’s Assets Under Management (AUM). This inflated AUM was then used to redeem GLP tokens at an overvalued rate, draining ETH, USDC, and WBTC from the vault.
This loop was executed multiple times, resulting in ~$42M in total losses. The GMX team confirmed the issue was limited to v1’s GLP vault on Arbitrum, paused related functions, and initiated a bounty program for fund recovery.
Incident Report
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to GMX, these are the critical security checks that could have prevented this incident (July 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$37.0M
Net Loss
4998000
Sources & References
Learn to Prevent the Next GMX
The GMX hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.