Skip to main content

The $42M GMX Hack: What Everyone Missed, and How Bug Hunter Found It

· 6 min read
Bug Hunter Team
Smart Contract Security Engineers

Introduction: Why This Matters​

In July 2025, a single overlooked detail in GMX's smart contracts drained $42 million in a matter of hours. Countless audits and trusted tools failed to see it coming. For developers and decision makers alike, the most unsettling part was this: the vulnerability was not obvious, yet it was enough to shake one of the largest DeFi protocols.

Then came a breakthrough. When we ran Bug Hunter on the same contracts, it flagged the exact vulnerability behind the exploit, the subtle refund-before-bookkeeping flaw that auditors and scanners had missed.

For us, it was more than validation. It was proof that DeFi does not have to live in fear of the next hack. Security can be continuous, reliable, and proactive. Bug Hunter shows what that future looks like.

Part 1: The GMX Hack in Plain Language​

GMX is a decentralized exchange running on Arbitrum, a scaling solution for Ethereum. Unlike centralized platforms, GMX relies on pooled liquidity provided by users, represented through GLP tokens. Traders open positions against this pool, and the system must constantly track balances and asset values.

On July 9, 2025, attackers discovered a weakness in the way GMX handled refunds during order execution. Specifically, the protocol made an external call to a user’s contract before it finished updating its internal accounting.

A malicious contract took advantage of that moment. It called back into GMX mid-transaction and manipulated values that should have been locked. This desynchronized the system’s internal bookkeeping and let the attacker inflate GLP token values, eventually draining around 42 million dollars from liquidity providers.

Although the majority of funds were returned after negotiations, the vulnerability showed how a tiny detail in smart contract logic can have massive financial consequences.

Part 2: Why Traditional Tools Missed It​

Most security scanners are built to catch surface-level issues such as:

  • Missing reentrancy guards
  • Unsafe arithmetic
  • Improper access controls

But the GMX exploit was different:

  • The entry point was hidden in a refund callback that looked harmless.
  • The real impact only emerged when combined with cross-contract accounting across GLP, AUM (assets under management), and ShortsTracker.
  • The vulnerability required reasoning about system-wide consistency, not just checking one function in isolation.

Traditional tools focus on local errors. The GMX exploit was a global logic flaw. That is why it slipped through.

Part 3: How Bug Hunter Adds Value​

Bug Hunter is designed to go beyond the limits of conventional tools. It creates value by focusing on system-level correctness and continuous protection.

  • Finds hidden risks: Identifies patterns that become exploitable only when multiple contracts interact in complex ways.
  • Understands system rules: Instead of asking "Is this line of code safe?", it asks "Does the entire protocol stay consistent under every possible interaction?"
  • Reduces business risk: For decision makers, Bug Hunter prevents multimillion-dollar losses, protects reputation, and builds lasting user trust.

For developers, this means fewer blind spots. For decision makers, it means stronger protection for assets, brand, and community trust.

Part 4: How Bug Hunter Detected the GMX Pattern​

Here is a simplified version of the vulnerable code:

function executeDecreaseOrder(Order order) public {
    _refund(order.receiver, amount);  // external call
    _updateShortsTracker();
    _updateAUM();
}

The issue is simple to describe. The refund happens before the accounting is finalized. If the receiver is a malicious contract, it can call back into GMX and manipulate state while the system is inconsistent.

Call Flow Diagram​

Here is what the vulnerable flow looked like:

OrderBook.executeDecreaseOrder()
   ├─ Vault.decreasePosition()
   ├─ refund()  → external call to receiver (attacker)
   │                  └─ re-enters Vault.increasePosition()
   │
   └─ finalize bookkeeping:
        - ShortsTracker.update()
        - AUM.update()

Bug Hunter identified that the external refund opened a reentrancy window. It also highlighted that important accounting (ShortsTracker.update and AUM.update) happened only after the external call, making the system exploitable.

After the incident, we ran Bug Hunter directly on the GMX contracts. The tool flagged the same refund-before-bookkeeping pattern that attackers exploited in July. When Bug Hunter surfaced this issue, it was a moment of pure joy for our team. Seeing the tool automatically identify such a subtle, cross-contract reentrancy, the very pattern that led to a 42 million dollar exploit, validated our efforts. It was proof that Bug Hunter does not just analyze code, it truly understands the deeper logic of smart contracts.

Part 5: Lessons for Developers​

The GMX exploit reinforced some timeless lessons for smart contract engineers:

  • Checks, Effects, Interactions: Always update state before making external calls.
  • Use reentrancy guards: Even in refund and payout flows.
  • Think in invariants: Security depends on consistent relationships between contracts and data.
  • Automate security early: Integrate tools like Bug Hunter into workflow to catch issues before they reach production.

Part 6: Why Decision Makers Should Care​

Smart contract security is not just a technical detail. It is a business-critical risk factor.

  • The GMX incident temporarily drained 42 million dollars, shaking trust across the ecosystem.
  • Even though funds were returned, the reputation damage and loss of confidence were unavoidable.
  • Traditional audits are essential, but they are snapshots in time. They secure the code as it was on the day of review, not the code you write tomorrow.

Bug Hunter provides continuous, automated security review. It catches vulnerabilities as they appear in the development process, long before they can cause damage in production.

For decision makers, the takeaway is clear: stronger security is not just a technical investment, it is strategic protection for the entire business.

Conclusion: The Future of Secure DeFi​

The GMX exploit showed how a small oversight can lead to massive financial losses. It also revealed that traditional tools are no longer enough to secure modern DeFi protocols.

Bug Hunter proved that it can detect precisely these kinds of risks. By identifying the same pattern that drained GMX, it demonstrated unique value as a system that catches what others cannot.

For developers, this means fewer emergencies and more robust code. For decision makers, it means reduced risk and stronger trust. For the ecosystem as a whole, it means safer and more reliable decentralized finance.

The lesson is clear: the era of surface-level bug hunting is over. To build a secure and trustworthy DeFi ecosystem, we must embrace continuous, system-level verification. With Bug Hunter, we are not just finding bugs, we are building a foundation of provable security for the future.