GMX Halts Trading After $40M Crypto Pool Drained in Attack

🎁 Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. JOIN NOW! 🔥

GMX Halts Trading After $40 Million Crypto Pool Drained in Attack

Written by Aaron S.,

Editor-In-Chief

Last Updated: July 10, 2025

Key Takeaways

GMX V1 froze trading after a $40 million exploit drained its asset pool and hurt GLP holders;
The attacker used a re-entrancy flaw to mint GLP tokens repeatedly with the same funds;
GMX shut down minting, trading, and leverage as stolen funds remain under investigation.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

BITDEGREE IN YOUR SOCIAL FEED

GMX's $0 first-generation decentralized exchange (DEX) was forced to suspend trading on July 9 after it suffered a security breach that resulted in the loss of around $40 million worth of cryptocurrency.

GMX V1, which first launched on the Arbitrum ARB $0.4037 network in 2021 and later expanded to Avalanche AVAX $20.78 , allows users to trade perpetual futures while liquidity providers earn fees through a token called GLP. This token is backed by a pool of assets that users deposit.

However, that pool was emptied after an attacker exploited a flaw in the system, which rendered GLP holders unable to redeem their tokens for the expected value.

How to Make Passive Money with NFT? (Explained!)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Data on GMX’s website showed that roughly $10 million in each Bitcoin BTC $117,223.46 and USDC USDC $0.9955 , about $8.5 million in Ethereum ETH $2,952.26 , nearly $1 million in USDT USDT $0.9950 , and a large amount of Uniswap UNI $8.75 and Chainlink LINK $15.32 tokens were stolen.

Suhail Kakar, a developer at TAC, explained on X that the exploit was a type of "re-entrancy" attack, where the smart contract was tricked into believing no funds had been withdrawn yet. This allowed the attacker to repeatedly create new GLP tokens using the same original funds.

Blockchain security firm PeckShield noted that the wallet used in the attack had been funded through Tornado Cash, likely to hide the trail. The stolen funds are currently stored in that wallet, while investigators attempt to track the transactions.

In response, GMX stopped all V1 trading on both Arbitrum and Avalanche, and also disabled GLP minting and leverage trading.

Resupply, a decentralized finance (DeFi) platform, confirmed a breach in one of its markets, which resulted in the loss of around $9.6 million worth of crypto assets. How did the incident happen? Read the full story.