GMX Hacker Promises to Return $42 Million in Stolen Assets

On July 9, 2025, the decentralized perpetuals trading protocol GMX, operating on the Arbitrum network, experienced a significant security breach. The exploit targeted the platform's GLP liquidity pool, resulting in the theft of approximately $42 million in various digital assets. The stolen assets included $10 million in Frax dollar, $9.6 million in wrapped BTC, and $5 million in DAI, with an additional $32 million remaining on the Arbitrum network. The hacker's wallet was observed to be holding close to $44 million in various digital assets following the heist.

In response to the incident, GMX offered the hacker a 10% white-hat bounty, which is a common practice in the cryptocurrency community to incentivize ethical hacking and the return of stolen funds. The platform also paused trading and token minting as a precautionary measure to prevent further losses. The hacker, in a surprising turn of events, has since indicated that the stolen funds will soon be returned. This development has raised hopes within the community that the majority of the lost assets may be recovered, similar to the recent case of Texture Finance, where the hacker refunded 90% of the loot after a $2.2 million exploit.

On July 11, the GMX hacker sent a message on-chain to the GMX deployer address stating, "Funds will be returned later." This message came after GMX had previously sent a message on-chain to the hacker acknowledging the GMXV1 vulnerability, expressing willingness to provide a 10% white hat bounty, and promising not to take further legal action if the remaining 90% of the funds are returned within 48 hours.

The exploit on GMX highlights the ongoing challenges faced by decentralized finance (DeFi) platforms in securing their systems against sophisticated attacks. The incident serves as a reminder of the importance of robust security measures and the need for continuous vigilance in the rapidly evolving landscape of digital assets. The community's response to the hacker's message, offering a white-hat bounty and pausing operations, demonstrates a proactive approach to mitigating the impact of such incidents and fostering a culture of responsible behavior within the DeFi ecosystem.