GMX Token Rises 14% as Hacker Returns Funds

The individual responsible for the $40 million exploit of GMX, a decentralized perpetual exchange, has begun returning stolen funds after accepting the project's $5 million white-hat bug bounty offer. The hacker exploited GMX's V1 GLP pool on Arbitrum, extracting over $40 million in cryptocurrencies such as USDC, FRAX, WBTC, and WETH, which forced GMX to suspend V1 trading and minting on both Arbitrum and Avalanche. Fortunately, GMX V2 and its native token remained unaffected, prompting the project to offer a 10% bounty to the hacker, with a promise of no legal action if funds were returned within 48 hours. On Friday, the exploiter communicated via on-chain messaging, stating, "ok, funds will be returned later." Following this, an address linked to the hacker returned $5.5 million FRAX (approximately $5.5 million) to the GMX Deployer, succeeded by another transfer of $5 million FRAX. Following the news, GMX's token, which had previously plummeted 28% to a low of $10.45, saw a surge of approximately 14%, trading at $13.25 shortly afterward. In a post-mortem analysis, GMX confirmed that it was affected by a re-entrancy vulnerability in the OrderBook contract, allowing attacks to manipulate Bitcoin's average short price, inflating the GLP liquidity provider token price, and redeeming this at a profit. Trading was halted immediately, and the team coordinated with partners to trace the funds while assuring users that GMX V2 was not compromised. Consequently, minting and redemption of GLP on Arbitrum will be disabled, and the remaining funds will be allocated for reimbursements. GMX also intends to hold DAO discussions on reimbursement measures and issued guidance to reduce similar risks in GMX V1 forks. GMX allows users to trade cryptocurrencies with leverage up to 100 times. The platform has accumulated $306 billion in total trading volume since its launch on Arbitrum One in 2021, with more than $265 million in current open interest among nearly 715,000 users.