GMX has opened its $44 million compensation scheme for victims of July’s hack.
The crypto exchange was able to recover most of the stolen funds after the exploiter returned millions of dollars in ETH and stablecoins.
+12
On Wednesday, July 9, the Arbitrum deployment of GMX V1’s GLP pool was drained for cryptocurrency worth more than $42 million at the time.
The exploit was pinned to a reentrancy attack, which takes advantage of a vulnerability in smart contracts that can place external calls to other contracts before updating their own state. This allows a malicious contract to reenter the original function and repeat withdrawals.
Following the incident, GMX developers offered a 10% white-hat bounty and promised not to pursue legal action if the funds were returned within 48 hours.
The next day, the hacker agreed to the deal and transferred most of the value that was stolen in ETH and stablecoins. Because the price of ETH increased in the intervening period, they were able to return over 90% of the stolen crypto’s value and still retain at least $3 million in profit.
On July 17, the GMX DAO (decentralized autonomous organization) opened a discussion on how to distribute the returned funds to investors who were affected by the hack.
After debating different options, the DAO elected to distribute funds via a new GLV token, underpinned by ETH, stablecoins, and WBTC returned by the hacker, as well as around $2 million provided from the DAO Treasury to make up a shortfall.
GLV essentially replaces the old GLP pool, with users reimbursed tokens on a one-for-one basis. GMX opened refunds on Aug. 13, letting GLP holders claim their new tokens from the GMX stake portal.