What happened
Beginning January 5, 2026, TMXTribe, a GMX fork on Arbitrum, was drained over roughly 36 hours. Rekt’s on-chain reconstruction, citing multiple security alerts, reported about $1.4 million in losses.
Security-alert reporting cited by Rekt described a fatal flaw in the unverified contract’s LP staking and swapping mechanics, enabling a repeatable mint-stake-swap-unstake loop.
Case & protocol details
Attack Timeline
The attacker repeatedly minted and staked TMX LP tokens with USDT, swapped the deposited USDT for the protocol’s USDG, unstaked the LP tokens, and sold the USDG. Rekt reported that the same sequence was repeated over the exploitation window.
Evidence & learning
Sources and on-chain records
- report Report x.com
- report Post-mortem rekt.news
- analysis CertiK alert account cited by Rekt x.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.