Circle Faces Criticism After $42 Million GMX Hack

Decentralized Finance (DeFi) platform GMX experienced a significant security breach, losing $42 million. This incident has raised alarms about the potential for similar attacks, particularly due to the widely forked nature of its codebase.

Key Takeaways

GMX was hacked for $42 million, with concerns about similar vulnerabilities in other projects.
Circle, the issuer of USDC, faced backlash for its slow response to the hack, missing a chance to freeze stolen funds.
Following the hack, the price of GMX token fell by about 25%.
The attack is believed to be linked to a bug in the GMX v1 code, with speculations of a reentrancy vulnerability.
The exploiter's rapid movement of stolen funds using Circle's tools raised significant concerns.

The hack reportedly stemmed from a flaw in the GMX v1 code, with security auditors from BlockSec indicating that a reentrancy vulnerability may be involved. In the aftermath of the breach, the price of GMX token dropped by approximately 25%, according to data from CoinMarketCap.

The GMX team confirmed the hack on X, reassured users that “the exploit does not affect GMX V2, its markets, or liquidity pools, nor the GMX token itself.” Furthermore, a developer has attempted to contact the attacker via an on-chain message, offering a 10% bounty for the return of the stolen funds.

Critics have pointed out Circle's lack of action during this incident. Circle had the ability to blacklist the hacker's address and could have frozen over $9 million of the stolen assets. The hacker used Circle’s own bridging tool to transfer $8 million USDC between the Arbitrum and Ethereum networks and then exchanged it for the unfreezable DAI stablecoin.

Blockchain investigator ZachXBT, known for criticizing Circle's responsiveness after hacks, stated, “Circle just does not care about the ecosystem.” He claims he alerted multiple team members minutes after the attack but received no response. He also directed comments toward Circle’s CEO, Jeremy Allaire.

In contrast, the swift action taken to freeze $1.3 million USDT (a version of Tether) that was briefly under the hacker's control highlighted a significant difference in responsiveness: that freeze occurred just 23 seconds too late.

GMX has been a prominent player in the DeFi space since its launch in September 2021, offering crypto perpetual trading directly on-chain. It gained a total value locked (TVL) of over $350 million during the peak of DeFi activity leading up to the collapse of UST/LUNA. Its TVL reached a high of around $700 million in May 2023, according to DeFiLlama.

As GMX's success has led to numerous forks—new projects based on existing code—concerns have arisen over potential vulnerabilities in these clone projects. Peckshield, a blockchain security firm, warned that the same vulnerability exploited in GMX v1 could be present in these forks.

Currently, around $28 million could be at risk across all v1 forks, with DeFiLlama identifying 64 such projects, though only 13 have a TVL exceeding $100,000. GMX has issued warnings to these forks through X, proposing mitigation strategies, including disabling leverage and halting the minting of GLP tokens.

For any tips or insights, feel free to reach out securely via Protos Leaks. For up-to-date news, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.