GMX Token Rises 14% After Hacker Begins $40 Million Return

• GMX Recovers After Attack and Partial Return of Funds
• Explorer accepts $5 million reward from project
• Exploration affected only Arbitrum's GLP V1 pool

The GMX token surged 14% after the person responsible for exploiting a $40 million exploit on the decentralized protocol began returning the funds. The surge comes after the project offered the hacker a $5 million reward as an incentive for voluntary repayment.

The breach affected GMX's GLP V1 liquidity pool on the Arbitrum network, resulting in the withdrawal of over $40 million worth of cryptocurrencies such as USDC, FRAX, WBTC, and WETH. As an immediate measure, GMX temporarily suspended trading and issuance of the V1 pool on both Arbitrum and Avalanche. The V2 version and the GMX token were not affected.

The GMX team published an on-chain proposal offering the attacker 10% of the exploited value as a reward for identifying the flaw, with a promise to not take legal action if the funds were returned within 48 hours. In response, the exploiter sent the message "ok, funds will be returned later," as recorded by PeckShield.

#PeckShieldAlert #GMX Exploiter msg: funds will be returned later pic.twitter.com/ohlOVYWSvD

—PeckShieldAlert (@PeckShieldAlert) July 11, 2025

Hours later, two deposits were made: one with 5,5 million FRAX and the other with 5 million FRAX, totaling $10,5 million returned to date. Additionally, approximately 10.000 ETH—equivalent to $30 million—was sent back in four separate transactions, according to PeckShield's tracking.

The price of the GMX token, which had fallen 28% after the attack, hitting a low of $10,45, quickly recovered, reaching $13,25 on Friday after the initial refunds.

According to the team's post-incident analysis, the vulnerability was identified in the OrderBook contract, where a reentrancy flaw allowed the exploiter to manipulate the average price of BTC short positions. This inflated the value of the GLP token, allowing for redemptions with undue profits. The team acted quickly to contain the impact, shutting down critical functions and coordinating the tracking of the stolen assets with specialized partners.