Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #7[unverifiable][awaiting moderator]in section: Security History

   “the code transferred ETH to the caller before invoking timelock.disableLeverage(), creating a reentrancy window”

   reviewerCode transferred ETH before calling timelock.disableLeverage(), creating the reentrancy windowConsistent with the general mechanism but I did not read the BlockSec or other technical sources for this specific ordering.
   citedblocksec.com/blog/gmx-incident-cross-con…r-year-old-guard

The claim was accurate when written but events since have overtaken it.

1. #11[stale][awaiting moderator]in section: Risk Assessment

   “Users who still hold GLP tokens should monitor official GMX communications regarding any recovery or migration pathway.”

   reviewerUsers who still hold GLP should monitor communications regarding any recovery or migration pathwayA recovery pathway was announced in August 2025, so the open-ended advice is out of date. The replacement is drawn from a single secondary source.
   Proposed correction (not yet applied)

   Users affected by the GLP exploit could claim compensation from GMX, paid in GLV (V2 liquidity vault) tokens, under a plan announced in August 2025.

The cited evidence supports part of the claim but not all of it.

1. #2[partially supported][awaiting moderator]in section: Security History

   “The attacker eventually accepted, returned approximately $37 million, and retained a $5 million bounty.”

   reviewerAttacker returned about $37 million and retained a $5 million bountyThe $37M figure is derived (42M minus 5M), not stated by the sources I fetched. Sources also give the bounty as both 10% and $5M.
   citedwww.theblock.co/post/362164/gmx-token-su…-million-exploitwww.halborn.com/blog/post/explained-the-…x-hack-july-2025
2. #3[partially supported][awaiting moderator]in section: Security History

   “The team offered a 10% white-hat bounty (~$4.2 million) with a 48-hour deadline for return of 90% of funds.”

   reviewerThe team offered a 10% bounty (~$4.2M) with a 48-hour deadlineA 10% bounty of $42M is $4.2M, but outlets also say $5M. The final retained amount of $5M is not reconciled with ~$4.2M anywhere on the page.
   citedwww.theblock.co/post/362164/gmx-token-su…-million-exploit
3. #6[partially supported][awaiting moderator]in section: Security History

   “The Halborn security firm noted that the vulnerable 2022 fix was not audited before deployment, which explains why multiple prior audits failed to flag the flaw.”

   reviewer2022 fix introduced the bug and it was unaudited, explaining why prior audits failed to flag itThe unaudited-fix part is supported. The explanatory clause about prior audits is the page's own inference.
   citedwww.halborn.com/blog/post/explained-the-…x-hack-july-2025
4. #8[partially supported][awaiting moderator]in the timeline

   “GMX awards a $1 million bug bounty to Collider research for discovering a critical vulnerability in the short position tracking system.”

   reviewerGMX paid a $1M bug bounty to Collider in 2022 for a short-tracking vulnerabilityThe bounty and year are supported. The 'short position tracking' description rests on a secondary analysis and the entry has no source.

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “when a reentrancy exploit drained approximately $42 million from its GLP liquidity pool”

   reviewerA reentrancy exploit on 9 July 2025 drained about $42 million from GMX V1's GLP poolDate and size are consistent across sources. A few outlets say about $40M.
   citedwww.halborn.com/blog/post/explained-the-…x-hack-july-2025www.theblock.co/post/361806/hacker-drain…ual-exchange-gmx
2. #4[confirmed][no action needed]in the timeline

   “Attacker sends an on-chain message accepting the bounty terms and begins returning funds. GMX token price rises approximately 14% on the news.”

   reviewerAttacker accepted the bounty on 2025-07-11Timeline entries carry no source field.
3. #5[confirmed][no action needed]in the timeline

   “Attacker exploits GMX V1's zero-slippage oracle pricing on the AVAX/USD market, extracting approximately $565,000 from GLP liquidity providers by manipulating external AVAX prices.”

   reviewerAVAX manipulation on 2022-09-18 yielding about $565,000, five cycles, OI caps $2M long and $1M shortThe section 2 range of '$500,000-$700,000' is looser than the single $565K figure but not contradictory.
   citedcointelegraph.com/news/decentralized-exc…pulation-exploit
4. #9[confirmed][no action needed]in the timeline

   “Abracadabra.money loses $13 million in an exploit targeting its lending cauldrons that used GMX V2 GM tokens as collateral.”

   reviewerAbracadabra lost $13M in an exploit on cauldrons using GMX V2 GM tokens; GMX contracts not compromisedThis is a third-party incident and not a GMX V1 security incident; the page labels it as indirect.
   citedcryptopotato.com/gmx-defends-contracts-a…auldron-exploit/
5. #10[confirmed][no action needed]in section: Background

   “The V2 architecture, which uses isolated GM liquidity pools, is the only active GMX product as of mid-2025.”

   reviewerV2 is the only active GMX product as of mid-2025The date qualifier is hedged correctly, but no later status was checked.
   citedcryptodaily.co.uk/2025/07/42m-stolen-in-…uts-down-trading