{"id":36427,"date":"2025-07-11T15:18:15","date_gmt":"2025-07-11T15:18:15","guid":{"rendered":"https:\/\/dogewisperer.com\/?p=36427"},"modified":"2025-07-11T15:18:15","modified_gmt":"2025-07-11T15:18:15","slug":"gmx-exploiter-return-40m-days-after-hack-token-zooms-higher","status":"publish","type":"post","link":"https:\/\/dogewisperer.com\/?p=36427","title":{"rendered":"GMX Exploiter Return $40M Days After Hack, Token Zooms Higher"},"content":{"rendered":"
\n

The attacker who drained over $40 million from GMX<\/a>\u2019s V1 contracts earlier this week has started returning funds, suggesting they\u2019ve accepted the project\u2019s $5 million white-hat bounty.<\/p>\n

The first signs came Friday via an on-chain message: \u201cok, funds will be returned later.\u201d<\/p>\n

Hours later, over $10.5 million in FRAX was sent back to GMX\u2019s deployer wallet. Security firm PeckShield flagged the returns<\/a>, which appear to be just the start, with more funds expected to follow.<\/p>\n

GMX is now trading at $13.15 having risen by 13% over the past 24 hours.<\/p>\n

Later on, over $40 million in various tokens were returned to the GMX Security Committee MultiSig address, Lookonchain noted.<\/p>\n

The breach, one of the largest DeFi exploits of the year, targeted GMX\u2019s GLP pool on Arbitrum. It exploited a re-entrancy flaw in the OrderBook contract, allowing the attacker to manipulate short positions on BTC, inflate GLP\u2019s valuation, and redeem it for outsized profits across USDC, WBTC, WETH, and FRAX.<\/p>\n

Reentrancy is a common bug that allows exploiters to trick a smart contract by repeatedly calling a protocol to steal assets. A call authorizes the smart contract address to interact with a user\u2019s wallet address.<\/p>\n

GMX responded by halting V1 trading and minting across both Arbitrum and Avalanche. A bug bounty worth more than 10% of the stolen funds was offered, with a promise of no legal pursuit if the full amount was returned within 48 hours (which the hacker seems to have adhered to as of European morning hours Friday).<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The attacker who drained over $40 million from GMX\u2019s V1 contracts earlier this week has started returning funds, suggesting they\u2019ve accepted the project\u2019s $5 million white-hat bounty. The first signs came Friday via an on-chain message: \u201cok, funds will be returned later.\u201d Hours later, over $10.5 million in FRAX was sent back to GMX\u2019s deployer […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[2],"tags":[3,4,5],"class_list":["post-36427","post","type-post","status-publish","format-standard","hentry","category-news","tag-crypto","tag-doge","tag-news"],"_links":{"self":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/36427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=36427"}],"version-history":[{"count":0,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/36427\/revisions"}],"wp:attachment":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=36427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=36427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=36427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}