GMX DeFi Hacker Returns 56.3 Billion Won Out of 78.2 Billion Won… Receives 6.9 Billion Won in Compensation

On the 9th, the DeFi-based trading platform GMX was hacked, exploiting a smart contract vulnerability, resulting in the theft of approximately $56.2 million (about 78.2 billion won) in cryptocurrency. However, within just two days, the hacker returned most of the stolen assets and accepted GMX's bug bounty of around $5 million (about 6.95 billion won), leading to an unexpected turn of events. According to the on-chain security company PeckShield, the attacker returned assets worth a total of $40.5 million (about 56.35 billion won), including ETH and legacy Frax, to GMX. This was a result of the hacker responding to GMX's proposed '10% white hat reward' program. The proposal's conditions included not pursuing legal action if all assets were returned. GMX announced immediately after the incident that it was an attack exploiting a re-entrancy vulnerability. The attacker used a design flaw in the GMX V1 smart contract to repeatedly call a specific function, artificially inflating the price of GLP (liquidity provider tokens). The hacker stole various assets such as WBTC, Frax, and Dai, then converted them to 11,700 ETH by bridging from Arbitrum to the Ethereum network. Subsequently, the hacker indicated in their first response that they would "return soon" and began returning assets in stages. First, they transferred $10.49 million (about 14.58 billion won) in Frax to the multisig wallet managed by GMX's security committee. The remaining $32 million (about 44.5 billion won) in ETH was returned at the original amount, despite its value increasing to $35 million (about 48.65 billion won) due to price appreciation. They kept approximately $3 million (about 4.17 billion won) in profits and took home a total compensation of around $4.5 million (about 6.25 billion won). This incident was limited to GMX's V1 version, and it was confirmed that the vulnerability did not exist in the GMX V2 protocol, which was designed with a focus on new users. GMX normalized operations by lifting the temporary restrictions on liquidity token issuance in its V2 on Arbitrum and Avalanche networks. Meanwhile, GMX's native token GMX initially plummeted after the incident but recovered, rising more than 13% within a day after news of the asset return. The series of responses has been relatively evaluated by the community as a stable risk management case.