GMX Offers 10% Bounty After $42M Hack on Arbitrum Platform

GMX, a decentralized exchange, recently faced a significant security breach, resulting in the loss of approximately $42 million from its Arbitrum-based v1 perpetual platform. In response to this incident, GMX issued an on-chain message to the hacker, offering a 10% white-hat bounty. The platform also stated that no legal action would be pursued if the remaining funds were returned within 48 hours. This approach is a common damage control tactic used by DeFi protocols when facing major exploits.

The attack occurred on July 9, and blockchain security firm Cyvers reported that the exploit originated from a malicious smart contract deployed by an address funded through Tornado Cash, an Ethereum-based privacy tool often used to obfuscate transactions. The attacker targeted a range of assets, including ETH, USDC, fsGLP, DAI, UNI, FRAX, USDT, WETH, and LINK. Blockchain data reveals that about $9.6 million has already been bridged to Ethereum’s mainnet, while the remaining funds remain on the Arbitrum network.

On-chain analysts suggest that the attacker carried out the hack by minting GLP tokens and redeeming them for high-value digital assets, which were later converted to ETH. This method allowed the attacker to exploit the platform's vulnerabilities and siphon off a substantial amount of funds.

Meanwhile, security experts have criticized Circle, the issuer of USDC, for its slow response to the incident. Crypto analyst Ultra noted that the exploiter held $30 million in USDC at one point and continued to swap other tokens into the stablecoin without being blacklisted. Even an hour after the attack, $4.3 million in USDC remained untouched in the exploiter’s wallet. The attacker has since shifted the USDC into DAI, a decentralized stablecoin on Ethereum. This complaint mirrors similar issues prominent investigator ZachXBT has raised about Circle’s recurring delays in freezing suspicious funds.

Launched in 2021, GMX is available across major blockchain networks including Solana, Avalanche, and Arbitrum. According to official metrics, the platform has processed over $305 billion in trading volume and collected more than $435 million in fees. Despite the recent security breach, GMX remains a significant player in the decentralized finance ecosystem, with a strong track record of processing large trading volumes and generating substantial fees.