GMX V1 exploit on 2025-07-09 ($42M reported)
Exploit on Arbitrum, 9 Jul 2025. Reported loss $42M. Last verified 4 Nov 2026.
major
Reported loss
$42M
as reported by the sources
Recovered
$40.1M
as reported
Status
Partially recovered
updated 26 Oct 2026
Date
Arbitrum
Summary
On 2025-07-09 a vulnerability in the GMX V1 deployment on Arbitrum let about $42 million be withdrawn from the GLP pool to an external wallet. After outreach by GMX the funds were returned under a bug-bounty arrangement, leaving about 40.1m in stablecoins for distribution to GLP holders, according to a GMX governance post.
- Protocol
- GMX V1
- Type
- Exploit
- Reported loss
- $42,000,000 · as stated: ~$42 million source: gov.gmx.io ↗
- Recovered
- $40,100,000 · as stated: 40.1m in stablecoins
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | July 9, 2025 | gov.gmx.io ↗ |
| Amount (USD) | ~$42 million | gov.gmx.io ↗ |
| Recovered | funds returned to the DAO | gov.gmx.io ↗ |
| Recovered (USD) | 40.1m | gov.gmx.io ↗ |
| Bounty | bug bounty | gov.gmx.io ↗ |
Primary sources
- GMX governance: Distribution plan for the recovered funds from Arbitrum GLP ↗ governance post · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram