Hacker Returns Stolen Funds from $40M GMX Exploit

July 11, 2025 — The hacker behind the $40 million GMX exploit has started returning the stolen crypto after agreeing to a $5 million white hat bounty offered by the GMX team.

Hacker Agrees to Return GMX Exploit Funds

The attacker who drained $40 million from GMX v1 sent an onchain message promising to return the stolen assets. The message, flagged by security firm PeckShield, confirmed the hacker’s acceptance of the $5 million bounty offered by GMX.

Within an hour, the hacker began returning the crypto. Approximately $9 million in Ether and $10.5 million in FRAX tokens were sent back to the address provided by the GMX team. At the time of writing, about $20 million of the stolen assets had been returned.

The GMX v1 exploit targeted a liquidity pool on Arbitrum by manipulating the value of GLP tokens. The attacker used a design flaw to drain funds from the pool.

GMX Team Offers Bounty to Resolve Exploit

To encourage the safe return of funds, GMX offered the hacker a $5 million white hat bounty. The team recognized the hacker’s skills and stated that claiming the bounty would allow the attacker to avoid legal risks tied to spending stolen assets.

In an onchain message, GMX warned that legal action would follow within 48 hours if the funds were not returned. The team offered the hacker 10% of the stolen assets as a reward, provided the remaining 90% was returned.