GMX Hacker Shocks Crypto World – Starts Returning Stolen Funds in Unprecedented Move

In a twist nobody saw coming, the GMX exploiter is voluntarily refunding stolen assets—proving even crypto villains have plot arcs.

The heist that backfired

After draining millions from GMX’s treasury, the anonymous attacker is now sending funds back to the protocol’s multisig wallet. No ransom demands, no negotiations—just partial refunds materializing on-chain like crypto manna from heaven.

DeFi’s weirdest morality play

Was it guilt? A clever exit scam? Or just a hacker who finally read the whitepaper? The decentralized finance space is buzzing with theories as blockchain sleuths track the mysterious transactions.

One thing’s certain: this is the first time in crypto history where a ‘rug pull’ turned into a ‘rug push’—much to the relief of bagholders and the dismay of bankruptcy lawyers.

GMX hacker makes a successful ETH trade

The hacker chose a fortunate moment to switch some of the funds to ETH. To consolidate the tokens taken from GMX V1 vaults, the hacker swapped them into 11,700 ETH. 

The trades happened just as ETH coasted around $2,600, before its big rally to over $3,000. Initially, the hacker swapped $32M in various assets, which are now valued at over $35M, netting a small gain. 

In theory, the hacker could choose to sell the ETH, return stablecoins or other tokens, and retain the difference. The hacker addresses have received multiple messages, finally responding to the original team message from xviv.eth. 

GMX uncovers flawed order book contract

The GMX team narrowed down the exploit issue to an order book contract. The contract itself protected against reentrancy, but the hacker called an external function outside the contract, bypassing the protection. 

Overall, the exploit cut a small dent in all token pairs, as GMX had multiple versions with SAFE vaults. During the day of the exploit, the GLP pool generated over $717K in daily fees, reflecting the heightened activity of exploiting the value of the GLP token.

The attacker was then able to manipulate the price of the GLP token, by bringing down the BTC short price to an anomaly of $1,913.70. This allowed the hacker to inflate GLP to an unfair price of $27, then use the unfair value to drain trading pools. 

GMX still carries $409.27M, down from a recent level above $480M before the exploit. The DeFi vaults suffered additional losses as an after-effect of the hack.

KEY Difference Wire helps crypto brands break through and dominate headlines fast