GMX v1 Exploit Leads to $42 Million Loss on Arbitrum

On July 10, 2025, GMX v1 on Arbitrum experienced a significant exploit, resulting in a loss of approximately $42 million. This incident was attributed to a design flaw identified by the security firm SlowMist, which prompted the immediate suspension of protocol activities.

The exploit highlighted potential vulnerabilities within the DeFi sector, underscoring the challenges in maintaining robust security measures. The breach allowed hackers to manipulate the GLP token prices, leading to substantial losses for users as funds were drained from the liquidity pool.

Key figures involved in the incident include SlowMist, who discovered the vulnerability, and the GMX Core Team, who responded swiftly by halting trading activities and offering a 10% bounty for the return of the stolen assets. This proactive measure aimed to mitigate further damage and restore user confidence.

The financial markets reacted immediately to the exploit, with the value of GMX's governance token experiencing a sharp decline. The incident resulted in a loss of public trust, emphasizing the critical need for stringent security protocols in DeFi platforms.

According to SlowMist's CISO, the vulnerability stemmed from the immediate update of the global average price when handling short positions. This price directly influences the calculation of the total asset under management (AUM), creating opportunities for price manipulation of the GLP token.

The exploit affected major stablecoins like USDC and put pressure on DeFi protocols to enhance their security defenses. It exposed vulnerabilities in decentralized mechanisms, impacting their usability and trustworthiness among users.

Historically, design flaws and reentrancy vulnerabilities have been persistent issues in the DeFi sector. This incident underscores the necessity for continuous security audits and improvements to foster safer crypto ecosystems. The event is expected to lead to increased scrutiny and innovation in crypto security measures.