Hacker Returns $10.49 Million in GMX Exploit, $3 Million ETH Profit Unrecovered

The hacker responsible for the GMX protocol exploit has returned a significant portion of the stolen funds, totaling approximately $10.49 million in FRAX, following an agreement to accept a $5 million white-hat bounty. This move was aimed at mitigating the broader impact on the market and recovering the stolen assets.

The exploit, which occurred on July 9, targeted the V1 protocol of GMX on the Arbitrum network. The hacker successfully looted various assets from the GLP liquidity pool, including stablecoins such as FRAX, USDC, and DAI, as well as wrapped tokens like WBTC and WETH. In response to the breach, GMX promptly suspended GLP trading, minting, and redemptions on both the Arbitrum and Avalanche networks to prevent further damage.

Initially, the hacker managed to steal around $42 million worth of assets. Out of this amount, approximately $32 million was later converted into 11,700 ETH. Given the current value of ETH, the hacker is left with a profit of around $3 million, which has not been returned.

To encourage the return of the stolen funds, GMX offered a 10% bounty with the assurance of no legal consequences if the hacker complied within 48 hours. While the hacker has started returning some of the assets, the $3 million ETH profit remains untouched, raising concerns within the crypto community.

Blockchain security firms have confirmed that the exploit was due to a re-entrancy vulnerability in the GLP pricing logic. This flaw allowed the hacker to repeatedly reuse the system and drain assets through multiple transactions.

Despite the hack, the native token of GMX experienced a price decrease of about 20 percent, dropping to approximately $11.20. However, the broader crypto market remained stable, with Bitcoin rising by nearly 2% and Ethereum increasing by around 6%. Many altcoin tokens also saw gains.

While some of the stolen assets have been recovered, the $3 million ETH profit remains a significant issue. This incident underscores the importance of robust DeFi security measures and demonstrates how white-hat deals can be used to limit the fallout from such breaches.