Leaderboard
85All-time rank
GMX V1 EVM
Jul 9, 2025
$42.0M
Lost
$42.0M
Recovered
$40.0M
Net loss
$2.0M
Majority95% recovered
On July 9, 2025, GMX V1 perpetuals on Arbitrum suffered a $42M exploit through reentrancy in executeDecreaseOrder(). Attacker exploited the assumption that _account is an EOA, using a contract to reenter, manipulate short positions, inflate GLP price, and profit via redemptions; attacker returned funds July 12, keeping a $5M bounty.
How the exploit worked
View reproducible PoCShare price manipulation.
Lost: 41M USD
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Reentrancy
- Technique
- Reentrancy
- Attribution
- Unknown
- Chains
Arbitrum
Event timeline
- Jul 9, 2025Exploit executed — $42.0M drained via reentrancy
- Attributed to Unknown
- Recovery status Majority 95%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)