GMX hacked for 42 million USD! "Reentrancy vulnerability" causes disaster, official report reveals compensation plan

The well-established decentralized perpetual futures exchange GMX was attacked by hackers on its V1 deployment on Arbitrum on July 9, resulting in losses of up to $42 million. This incident once again raised security alarms in the DeFi field. On the evening of July 10, Taiwan time, GMX published a detailed report on the X platform, revealing the root cause of the attack, initial response measures, and subsequent plans, as well as explaining how to compensate affected users.

GMX Hacked Reason: "Reentrancy Vulnerability" Exploited

According to GMX's official report, the attack occurred on July 9, 2025, at 12:30 PM (UTC). The attacker exploited a re-entrancy attack vulnerability in GMX V1 on Arbitrum. The hacker directly called the increasePosition function in the Vault contract, bypassing the mechanism for calculating the average short price by the PositionRouter and PositionManager contracts in the normal process.

The attacker manipulated the average short price of Bitcoin from $109,505.77 to $1,913.70, and used a flash loan to purchase GLP (GMX liquidity token) at a price of $1.45, opening a position worth $15.38 million, ultimately pushing the GLP price above $27 and cashing out huge profits.

The report indicates that the attack entry point is located in a certain function of the OrderBook contract. Although this function has a nonReentrant modifier, it only prevents reentrancy within the same contract and fails to prevent cross-contract attacks. This highlights the potential security blind spots in DeFi protocols during complex interactions.

Initial Response Measures and Follow-up Plans of GMX

In response, GMX quickly took action after discovering the vulnerability, suspending trading on Avalanche to prevent further losses, and contacting Arbitrum, exchanges, bridging protocols, and stablecoin issuers (such as Circle, Tether, Frax) to track the stolen funds, while also reaching out to the attacker through on-chain messages. GMX further confirmed that GMX V2 does not have similar vulnerabilities, as its airdrop average price calculation and order execution are completed within the same contract.

To address the aftermath of the attack and protect user interests, GMX has proposed the following specific plans:

Capital allocation and compensation preparation: Currently, there are approximately 3.6 million dollars worth of tokens in the GLP pool, reserved due to open positions. The V1 fees for GLP on Arbitrum amount to about 500,000 dollars (after deducting the 30% fee automatically converted to GMX), which will be transferred to the GMX DAO treasury for compensation to affected GLP holders. The remaining funds of GLP on Arbitrum will be allocated to the compensation pool for affected GLP holders to apply.

Disable GLP Minting and Redemption: GLP minting and redemption on Arbitrum will be disabled. GLP minting on Avalanche will be disabled, but the redemption function remains open, allowing users to handle it flexibly.

Position and Order Management: After disabling GLP redemption on Arbitrum, the V1 position closure feature on Arbitrum and Avalanche will be enabled, allowing users to close existing positions. However, the opening function for V1 will not be enabled to prevent similar attacks from occurring again. Existing V1 orders on Arbitrum and Avalanche will no longer be executed, and users must cancel all V1 orders themselves.

Subsequent Governance Discussion: GMX DAO will initiate governance discussions to plan further compensation measures, ensure fair distribution of remaining funds, and develop long-term preventive strategies.

Support esGMX staking: Users staking esGMX with GLP on Arbitrum and Avalanche can continue to stake. Users on Avalanche can redeem GLP at any time, but if GLP is not used for staking, redemption is recommended.

Suggestions for GMX V1 Fork: GMX urges all V1 fork projects to take two measures to prevent similar attacks:

1. Disable leverage function;

2. Restrict GLP minting.

The GMX hacking incident once again highlights the complex security challenges faced by DeFi protocols in their rapid development. Although GMX responded quickly and published a detailed report and compensation plan, the incident still serves as a reminder to all DeFi participants to remain highly vigilant about potential smart contract vulnerabilities while enjoying the conveniences brought by Decentralized Finance. This also prompts the entire DeFi ecosystem to reflect more deeply on protocol security and risk management.