GMX token drops by 20% after exchange hack

What’s new? On September 18, GMX, a decentralized exchange (DEX), was subjected to an exploit, in which hackers managed to withdraw $565 000 from the platform. The exchange’s native token has fallen by 20% in the last 24 hours, from $48,70 to $38,65 (data from aggregator CoinGecko). Representatives of GMX confirmed the price manipulation on AVAX/USD pair and added that the GLP and GMX trading markets continue to operate as usual.

We were notified of price manipulation of AVAX/USD on reference exchanges by monitoring systems and community members.While we review the occurrence, open-interest for AVAX has been capped at $2m long / $1m short.GLP and GMX trading markets continue to operate normally.— GMX 🫐 (@GMX_IO) September 18, 2022

What else is known about the incident? According to Cointelegraph, hackers took advantage of features on the exchange such as “minimal spread” and “zero price impact.” This made it possible to commit an exploit that affected GLP token holders who provide liquidity in AVAX tokens on the exchange.

Cointelegraph’s piece

Joshua Lim, head of derivatives at Genesis Trading, a brokerage firm, said that hackers successfully profited from the AVAX/USD market by opening large positions at zero slippage and then transferring the AVAX/USD to centralized exchanges at a higher price. This operation was repeated five times, beginning at 01:15 UTC on September 18. In each cycle, more than 200 000 AVAX tokens were transferred (about $4-5 million per cycle). As a result, the hackers managed to make a profit of about $565 000.

2/ last night, trader X successfully extracted profits from GMX's AVAX/USD market by opening large positions at 0 slippage, then moving AVAX/USD on other venues in their favorthis created a sinusoidal pattern for over an hour as X switched from long to short 5 times pic.twitter.com/gcFDk4hAwW— Joshua Lim (@joshua_j_lim) September 18, 2022

The GMX crypto exchange was launched in late 2021. On it, liquidity providers provide stablecoins and BTC, ETH, and AVAX cryptocurrencies in exchange for GLP tokens. GMX is partially recovered as of September 19, 09:30 UTC, and is trading at $39,11.

On September 7, Nereus Finance, a decentralized platform, lost 370 000 USDC as a result of an exploit. Hackers withdrew funds by manipulating the price of AVAX tokens. The attack took place through arbitrage trades, using 51 million USDC borrowed. The attackers then transferred tokens from the Avalanche network to Ethereum.