GMX Hacker Returns $40M After Major Exploit, Token Soars

The attacker behind this week’s $40 million exploit of GMX’s V1 contracts has begun returning stolen funds, propelling the protocol’s token sharply higher.

Earlier this week, the exploit targeted a reentrancy vulnerability in GMX’s OrderBook contract, enabling the attacker to manipulate BTC short positions, artificially inflate the value of GMX’s GLP pool, and redeem assets for outsized profits.

In a surprising turn, the exploiter appears to have accepted GMX’s offer of a $5 million white-hat bounty. The first indication came Friday via an on-chain message stating, “ok, funds will be returned later.”

Just hours afterward, over $10.5 million in FRAX stablecoins was transferred back to GMX’s deployer wallet. Blockchain security firm PeckShield flagged the initial returns and noted that further funds were likely on the way.

By the end of Friday, more than $40 million worth of various tokens had been sent back to the GMX Security Committee’s multisig wallet, according to blockchain analytics firm Lookonchain. The returned assets included approximately 9,000 ETH and 10.5 million FRAX, among others.

PeckShieldAlert (@PeckShieldAlert)
“#PeckShieldAlert #GMX Exploiter has returned a total of $37.5M worth of cryptos, including ~9K $ETH & 10.5M $FRAX to the #GMX Security Committee Multisig address.”
July 11, 2025

Following news of the repayments, GMX’s token surged 13% in the past 24 hours, climbing to around $13.15.

The exploit ranks among the largest DeFi breaches of 2025. It specifically targeted the GLP pool on the Arbitrum network by exploiting a reentrancy bug—a vulnerability that allows attackers to repeatedly interact with a smart contract before the initial transaction completes, enabling them to drain funds unexpectedly.

In response to the incident, GMX swiftly paused all V1 trading and token minting on both Arbitrum and Avalanche. The protocol issued a public bug bounty offer worth over 10% of the stolen funds, pledging not to pursue legal action if the full amount was returned within 48 hours—a timeline the hacker appears to have honored as of Friday morning in Europe.

With funds largely recovered and trading resuming, the incident serves as a stark reminder of lingering security risks in decentralized finance—even as protocols move quickly to mitigate damage and secure user trust.