Incident Overview
On January 6, 2026, TMX decentralized exchange on Arbitrum suffered a $1.4 million exploit through an unverified contract when an attacker repeatedly executed a loop involving minting and staking TMX LP with USDT, swapping for USDG, unstaking, and selling to drain USDT, wrapped SOL, and WETH from the contract.
CertiK's monitoring systems detected the attack on an unverified smart contract associated with TMX deployed on Arbitrum, flagging the unusual transaction patterns that led to the $1.4 million loss. The attacker discovered they could execute a profitable loop that involved minting and staking TMX LP tokens using USDT, then swapping the USDT for USDG tokens, unstaking their position, and selling the acquired USDG. According to CertiK's analysis, this process was repeated numerous times in succession, with each iteration draining additional value from the contract's liquidity pools.
The vulnerability likely stemmed from improper validation of staking and minting ratios or inadequate checks on the swap pricing mechanism, allowing the attacker to extract more value than they deposited with each cycle. The repeated execution of this loop systematically drained the contract's holdings of USDT, wrapped SOL, and WETH until approximately $1.4 million worth of assets had been extracted. The use of an unverified contract suggests the exploit may have gone undetected longer due to lack of public code auditing.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to TMX, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next TMX
The TMX hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.