GMX, a cross-chain decentralized exchange specializing in perpetual futures trading, warned on Wednesday that an initial version of its platform was exploited.
Roughly $40 million worth of tokens were siphoned from GMX V1, which debuted on the Ethereum layer-2 scaling network Arbitrum in 2021, to an unknown wallet, GMX said on X. In response, GMX V1 trading was disabled, alongside the minting and redeeming of GMX’s GLP token on Arbitrum and the layer-1 network Avalanche, GMX said.
GMX was recently changing hands around $11.19, a nearly 21% drop over the past day, according to crypto data provider CoinGecko. GMX’s GLP token is designed to allow purchasers to earn fees in Ethereum or Avalanche from users’ activity on the exchange by effectively providing liquidity.
Investors can swap assets like Bitcoin and Ethereum for GLP tokens through GMX’s website, and those funds are then pooled together. In theory, GLP holders are able to sell the token back to GMX for assets in the liquidity pool—but most of those funds went missing on Wednesday.
That included around $10 million worth of Bitcoin, $10 million worth of Circle’s USDC stablecoin, $8.5 million worth of Ethereum, around $1 million worth of Tether’s USDT stablecoin, as well as substantial amounts of the Uniswap and Chainlink tokens, according to a dashboard on GMX’s website.
As the amount of money in the GLP liquidity pool plummeted on Wednesday, the supply of GLP tokens increased. Suhail Kakar, who leads developer relations for TAC, wrote on X that the exploit appears to be a “re-entrancy” attack that abused the logic behind minting GLP tokens.
“The attacker could trick the contract into thinking they hadn’t withdrawn anything—and mint more tokens repeatedly, using the same base funds,” Kakar explained. “This wasn’t a smash-and-grab. It was a long-planned, precision hit.”
Kakar, along with the blockchain security and data analytics firm PeckShield, noted that the attacker’s wallet was funded days before via Tornado Cash, the Ethereum coin mixer that the U.S. government previously sanctioned for its alleged use in money laundering.
GMX advised users on X to disable leverage trading and GLP minting. PeckShield said the vulnerability likely applies to forked versions of GMX, urging them to take caution as well.
Re-entrancy vulnerabilities allow an attacker to cram multiple calls—or interactions with a smart contract, which holds the code that powers decentralized apps—into a single function, tricking a smart contract into calculating an improper balance. One of the most prominent examples was the $55 million 2016 DAO hack on Ethereum.
Wednesday’s exploit is distinct from Bybit’s $1.4 billion loss in February, in which a developer’s workstation was compromised, ultimately leading to the largest crypto hack of all time.
Within GMX’s official Telegram channel, some users wondered whether GLP token investors would be refunded. On X, GMX said it plans on posting a detailed postmortem once the project’s investigation is complete.
In a message sent to the attacker on-chain, GMX offered a “10% white-hat bounty,” equating to $4 million. Urging a “swift and ethical resolution,” the project said it would pursue no further legal action if the “funds are returned within 48 hours.”
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
