Worked example · 2025-07

GMX V1 GLP global-short-tracking exploit — Arbitrum — 2025-07-09

Loss: approximately $42M extracted from GMX V1 GLP pool on Arbitrum on 2025-07-09. GMX V1 was the protocol's deprecated-but-not-decommissioned legacy version, retained in production after the late-2023 V2 launch because of LP migration friction; the drained surface was the GLP global-short-tracking accounting structure specific to V1.
Recovery: near-100% via 10% white-hat bounty offer. Per the GMX operator post-mortem and corroborating BlockSec / PeckShield / SlowMist forensic threads, the attacker accepted the published bounty terms (10% white-hat reward + no-prosecution commitment) and returned approximately $37M to GMX's recovery multisig over 2025-07-10 to 2025-07-14, retaining ~$5M as the negotiated bounty. Operator-funded compensation made affected V1 LPs whole within Q3 2025. The recovery rate (~88% on-chain return + 100% LP make-whole) is among the cleanest 2025 outcomes for an EVM-mainnet exploit at this scale.
OAK Techniques observed: OAK-T11.013 (Legacy-Version Maintenance Attack Surface — the canonical anchor; GMX's operational decision to maintain V1 in production without backporting known vulnerability fixes converted the deprecated version's residual exploitable surface into a $42M loss. See techniques/T11.013-legacy-version-maintenance-attack-surface.md). OAK-T9.001 (Oracle / pricing manipulation — GLP-global-short-tracking accounting subclass; the specific vulnerability class exploited on V1) + OAK-T9.005 (state-machine accounting flaw in V1's swap-and-stake transaction logic).
Attribution: pseudonymous; the attacker engaged with the bounty negotiation surface in pseudonymous form on-chain. No off-chain identification was published. The negotiation-acceptance behaviour is one of the cleaner behavioural signals for a pseudonymous-individual attacker classification rather than a state-actor / OAK-G01 classification (the OAK-G01 base rate is total laundering, not negotiation-acceptance).
Key teaching point: Legacy-version maintenance during multi-version protocol rollouts is a discrete attack-surface variable. GMX V2 launched in late 2023 with substantial accounting-and-pricing improvements over V1; V1 continued to operate with substantial residual TVL through 2024-2025 because of LP migration friction and the operator-side decision to maintain V1 indefinitely as a deprecated-but-not-decommissioned product. The July 2025 exploit specifically targeted V1's GLP global-short-tracking accounting flaw, which had been known to the operator team but not patched on V1 because of the deprecation-vs-fix tradeoff. Future T9.x contributions should explicitly enumerate legacy-version-maintenance as a discrete operational decision class composing with M22 rotate-on-disclosure discipline applied to deprecated protocol versions.

Summary

GMX is a perpetual-futures and spot-AMM protocol on Arbitrum and Avalanche, originally launched in 2021 (V1) with a substantial V2 architecture rollout in late 2023. V1's GLP (GMX Liquidity Provider) pool used a global-short-tracking accounting structure that calculated GLP's per-share value partially as a function of net global short positions held against GLP's underlying asset basket; this accounting structure was known to the operator team to have a manipulable surface via crafted swap-and-stake transactions, but had not been patched on V1 because of the protocol-team's deprecation-vs-fix tradeoff after V2's launch.

On July 9, 2025, an attacker on Arbitrum used a series of crafted swap-and-stake transactions against V1's GLP pool to manipulate the global-short-tracking accounting into an artificially-inflated state, redeemed GLP shares at the inflated computed-value, and extracted approximately $42M before the price impact reverted on closing the manipulation transactions.

GMX's operator team identified the exploit within hours, paused V1's affected functions, and published an on-chain message-channel bounty offer (10% of extracted value as white-hat reward; commitment to no prosecution if returned within the bounty window). The attacker negotiated and accepted the bounty terms, returning approximately $37M to GMX's recovery multisig over the following days while retaining approximately $5M as the negotiated bounty. Operator-funded compensation made affected V1 LPs whole.

The case is structurally important as the canonical 2025 worked example for legacy-version-maintenance-as-attack-surface and pairs with the broader cohort of "deprecated-but-not-decommissioned-version" cases that produce ongoing exploitable surfaces (Yearn V1 February 2023 in examples/2023-02-yearn-v2.md is a structurally-similar earlier case with a different mechanism but the same operational-decision-class root cause).

Timeline (UTC)

When	Event	OAK ref
2025-07-09 ~early UTC	Attacker initiates crafted swap-and-stake sequence against V1 GLP pool on Arbitrum	T9.001 + T9.005 (manipulation)
2025-07-09	Attacker manipulates global-short-tracking accounting into artificially-inflated state	T9.001 (manipulation peak)
2025-07-09	Attacker redeems GLP shares at inflated computed-value; ~$42M extracted	T9.001 / T9.005 (extraction)
2025-07-09 (within hours)	GMX team identifies exploit; pauses V1 affected functions	M34 (operator response)
2025-07-09 (same day)	GMX publishes on-chain message-channel bounty offer: 10% of extracted value as white-hat reward + no-prosecution commitment	M35 (whitehat-rescue-coordination)
2025-07-10 to 2025-07-14	Attacker accepts bounty terms; returns ~$37M to GMX recovery multisig in tranches	M35 (recovery in progress)
2025-07 onwards	GMX deploys operator-funded compensation framework for affected V1 LPs; full make-whole within ~Q3 2025	(recovery; near-100%)

What defenders observed

Pre-event (operator-team aware of vulnerability but deprecation-vs-fix decision). The GMX operator team's awareness of the V1 global-short-tracking accounting flaw was documented in internal team communications (publicly disclosed in the post-incident operator post-mortem); the deprecation-vs-fix decision was a reasoned operational choice given the constraint that V1 LPs could not be unilaterally migrated to V2 and that V1 was already deprecated. The pre-event risk-assessment surface existed but the operational decision was to accept the residual risk in favour of LP-migration-friction-reduction.
At-event (multi-investigator detection chain within hours). The detection chain ran in parallel across at least four independent providers within the first 2-4 hours of the on-chain attack window. BlockSec PhalconHQ flagged the anomalous global-short-tracking state mutation and published the function-level walkthrough of the swap-and-stake manipulation sequence. PeckShield issued the cumulative-loss aggregation (~$42M) and the on-chain trace breakdown across the manipulation transactions. SlowMist attached the funding-source tracking and the post-extraction wallet correlation. Halborn published the defender-oriented post-mortem framing the case as a legacy-version-maintenance operational-decision-class incident. The same-hour detection signal across multiple independent providers reflects the operational maturity of the 2025 forensic-provider ecosystem; the cohort-recognition of the GLP-global-short-tracking-manipulation pattern was substantially faster than for earlier 2023-2024 GMX-class incidents.
At-event (rapid pause + bounty offer). The detection-to-pause latency was approximately 2-4 hours per public timeline; the same-day bounty offer follows the post-Euler-2023 operating norm with a substantially-shorter negotiation window than earlier cases. The pre-authorised bounty-offer template — operator-side preparation work that the GMX team had completed before the incident — was the load-bearing operational variable that made same-day publication feasible.
Post-event (near-100% recovery via white-hat bounty acceptance). The 10% bounty + no-prosecution commitment produced rapid attacker-acceptance and near-100% recovery (~$37M of ~$42M returned across 2025-07-10 to 2025-07-14, with the residual ~$5M retained as the negotiated bounty). The post-Euler-2023 negotiation pattern is now mature enough that operator-side rapid bounty offers reliably produce rapid attacker-acceptance for the cohort of attackers who are willing to accept negotiated outcomes. The GMX V1 outcome sits at the high end of the 2025 bounty-mediated recovery distribution alongside KiloEx (~100%) and ZKsync (~100%), with Loopscale (~50%) and Resupply (~10%) at the lower end of the same distribution.
Post-event (operator-funded LP make-whole as a discrete recovery class). GMX deployed operator-funded compensation framework for affected V1 LPs and produced full make-whole within Q3 2025. This is the same recovery class as DeltaPrime September 2024 (operator-team reimbursement from reserves) and Banana Gun September 2024 (operator-team reimbursement from operating reserves); the GMX July 2025 case is the largest 2025 datapoint for this recovery class, with the bounty-mediated on-chain recovery substantially reducing the operator-side compensation burden.

What this example tells contributors writing future Technique pages

Legacy-version-maintenance is a discrete operational decision class. Future T9.x contributions should explicitly enumerate legacy-version-maintenance-vs-decommissioning as a load-bearing operational decision class. The decision space is: (a) decommission the legacy version (highest mitigation, highest LP-migration-friction); (b) fix the legacy version (medium mitigation, medium operator-team-resource-cost); (c) maintain unfixed (lowest immediate cost, residual exploitable surface). GMX V1 chose (c) and produced the canonical 2025 worked example for that decision-outcome.
Multi-version protocol rollout audit-discipline is a discrete pre-deployment check class. When a new version of a protocol launches, the legacy version's residual-vulnerability surface is itself an audit class composing with general-purpose pre-deployment audit. Future Technique contributions should treat per-version-residual-vulnerability-tracking as a load-bearing variable.
Post-Euler-2023 negotiation-pattern maturity. The GMX July 2025 case demonstrates that the post-Euler-2023 negotiation pattern has matured to the point where operator-side rapid-bounty-and-no-prosecution offers reliably produce near-100% recovery for the cohort of attackers willing to accept negotiated outcomes. Future Technique-page contributions should treat this maturity as a load-bearing variable when comparing 2023-and-later vs pre-2023 recovery outcomes.

Public references

GMX operator-side post-mortem (July 2025) — [gmxpostmortem2025].
PeckShield on-chain trace — [peckshieldgmxv12025].
BlockSec function-level walkthrough — [blocksecgmxv12025].
SlowMist incident analysis — [slowmistgmxv12025].
Halborn defender-oriented post-mortem — [halborngmxv12025].

Citations

[gmxpostmortem2025] — GMX operator-side post-mortem; documents the legacy-version-maintenance operational-decision context and the bounty-recovery framework.
[peckshieldgmxv12025] — PeckShield on-chain trace.
[blocksecgmxv12025] — BlockSec function-level walkthrough.
[slowmistgmxv12025] — SlowMist incident analysis.
[halborngmxv12025] — Halborn defender-oriented post-mortem.
[zhou2023sok] — academic taxonomy classifying this as an oracle / accounting-manipulation chain.

Discussion

GMX V1 July 2025 is the canonical 2025 worked example for the legacy-version-maintenance-as-attack-surface operational decision class and is structurally important for OAK because it demonstrates that operator-side reasoned decisions to accept residual risk in deprecated protocol versions produce ongoing exploitable surfaces with substantial cumulative-loss potential. The case is a cleaner instance of the operational-decision-class than Yearn V1 February 2023 (which had a configuration-rot dimension that complicated the attribution to deprecated-version-maintenance specifically); future Technique-page contributions should treat GMX V1 July 2025 as the canonical reference and Yearn V1 February 2023 as a related-but-distinct case.

The post-Euler-2023 negotiation-pattern maturity observation is itself a useful framework-level contribution; the comparison of GMX V1 (rapid bounty-and-recovery, near-100%) vs Resupply Finance (partial bounty, ~10% recovery) suggests that recovery outcomes depend on operator-side bounty-offer-magnitude and attacker-cohort-preference rather than on the underlying T9.x subclass. Future Technique-page contributions should treat operator-side bounty-offer-magnitude and attacker-cohort-preference as load-bearing variables in recovery-outcome analysis.

The mitigation surface composes across OAK-M16 pre-deployment audit (for new versions), OAK-M22 rotate-on-disclosure discipline (applied to deprecated versions specifically), OAK-M34 emergency-pause (for rapid post-detection response), OAK-M35 whitehat-rescue-coordination (with mature post-Euler-2023 negotiation pattern), and a candidate OAK-M-class addition: legacy-version-decommissioning-discipline as a specific operational mitigation class composing with M22.