Decentralized crypto exchange GMX was exploited for approximately $40 million on July 9 through a suspected re-entrancy attack targeting its Arbitrum-based GLP liquidity pool. The attacker repeatedly minted GLP tokens, draining around $10 million in Bitcoin, $8.5 million in Ethereum, and additional amounts in USDC and other assets. GMX immediately paused trading on its V1 platform across Arbitrum and Avalanche and offered a 10% white-hat bounty—about $4 million—if the stolen funds are returned within 48 hours. The team confirmed GMX V2 and its native token remain unaffected, and security audits are underway to assess and reinforce the platform’s vulnerabilities.