GMX Returns $40 Million After Hacker Accepts $5 Million Bounty

The decentralized trading platform GMX recently experienced a significant security breach, with an attacker exploiting a vulnerability in the platform’s first version, GMX V1, and stealing over $40 million worth of cryptocurrency. The attacker targeted the OrderBook contract on the Arbitrum blockchain, manipulating the short trading price of Bitcoin (BTC) and inflating the value of the GLP token to cash out and make a profit. The attack affected several digital coins, including USDC, Frax, Wrapped Bitcoin, and Wrapped Ethereum.

In response to the breach, GMX swiftly halted trading and token minting on its V1 system across both the Arbitrum and Avalanche networks. Notably, GMX V2 and the platform’s primary token remained unaffected by the attack. To mitigate the damage and encourage the return of the stolen funds, GMX offered a white-hat bounty worth $5 million and promised no legal consequences if the funds were returned within 48 hours. The hacker accepted the offer, returning the stolen funds in two large batches. The first batch consisted of $5.5 million worth of Frax, followed by another $5 million. Subsequently, the attacker returned approximately 9,000 ETH, worth around $27 million, bringing the total amount returned close to the full sum stolen.

This approach by GMX is not uncommon in the crypto world and is often used to encourage cooperation after significant breaches. The platform’s token initially dropped by over 28% following the attack but quickly rebounded by more than 13% once the attacker agreed to return the funds. GMX expressed gratitude to the hacker on-chain for returning the money and has taken steps to enhance the platform’s security. The team has permanently disabled GLP minting and redemption on Arbitrum, allowing affected users to close their positions. Leftover funds will be used to compensate those impacted by the breach.