What happened
Beginning January 5, 2026, TMXTribe, a GMX fork on Arbitrum, was drained over roughly 36 hours. Rekt’s on-chain reconstruction, citing multiple security alerts, reported about $1.4 million in losses.
Security-alert reporting cited by Rekt described a fatal flaw in the unverified contract’s LP staking and swapping mechanics, enabling a repeatable mint-stake-swap-unstake loop.
How it happened
The attacker repeatedly minted and staked TMX LP tokens with USDT, swapped the deposited USDT for the protocol’s USDG, unstaked the LP tokens, and sold the USDG. Rekt reported that the same sequence was repeated over the exploitation window.
Protocol details
Evidence
- report CertiK TMX Tribe alert x.com
- report @certikalert incident report x.com
- report Rekt TMXTribe on-chain incident reconstruction rekt.news
- report CertiK alert account cited by Rekt x.com
- report UPay Research Q1 2026 report blog.upay.best
- analysis KuCoin: CertiK TMX incident flash kucoin.com
- analysis DeFiLlama defillama.com
- analysis NullTX: CertiK flags TMX exploit nulltx.com
- analysis ChainCatcher: Cyvers USDGambit and TLP alert chaincatcher.com
- analysis Crypto Economy: Arbitrum proxy contract attack crypto-economy.com
- analysis CryptoNews: Arbitrum ProxyAdmin hack coverage cryptonewsz.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
