$40M Returned by GMX Exploiter Within Days, Fueling Token Rally

GMX Hacker Returns $40M Following High-Profile Exploit, Token Rallies

A hacker who stole more than $40 million from GMX’s V1 contracts earlier this week has begun returning the funds, triggering a sharp rise in GMX’s token price.

The attack, one of the biggest decentralized finance (DeFi) breaches so far this year, stemmed from a reentrancy vulnerability in GMX’s OrderBook contract. The exploit allowed the attacker to manipulate short positions on bitcoin (BTC), artificially inflate the value of GMX’s GLP pool, and extract significant profits in various tokens, including USDC, WBTC, WETH, and FRAX.

Signs of a turnaround emerged Friday, when an on-chain message from the attacker stated, “ok, funds will be returned later.” Not long after, over $10.5 million in FRAX was transferred back to GMX’s deployer wallet, flagged by blockchain security firm PeckShield.

By Friday afternoon, more than $40 million in assets—including roughly 9,000 ETH and 10.5 million FRAX—had been sent to the GMX Security Committee’s multisig wallet, according to data from Lookonchain.

PeckShieldAlert (@PeckShieldAlert)
“#PeckShieldAlert #GMX Exploiter has returned a total of $37.5M worth of cryptos, including ~9K $ETH & 10.5M $FRAX to the #GMX Security Committee Multisig address.”
July 11, 2025

The return of the funds coincided with a significant price recovery for GMX’s token, which climbed 13% over the past 24 hours to trade around $13.15.

The incident prompted GMX to halt V1 trading and token minting on both Arbitrum and Avalanche networks. Following the attack, the project offered a $5 million white-hat bounty—more than 10% of the stolen amount—and pledged no legal consequences if the funds were returned within 48 hours. The hacker appears to have complied with this deadline as of Friday morning in Europe.

Reentrancy vulnerabilities remain one of DeFi’s most persistent threats, allowing attackers to repeatedly call smart contract functions in a single transaction to drain assets. GMX’s rapid response and partial fund recovery highlight both the risks and resilience present in decentralized finance today.