In a surprising twist, the cyber attacker who stole millions from GMX’s V1 GLP pool earlier this week seems to have had a change of heart and is now returning the stolen funds.
Blockchain security firm PeckShield Alert spotted the on-chain movements, revealing that the hacker has sent back around $37.5 million so far. The returned assets, mainly in ETH and FRAX, were transferred in multiple transactions around 8:00 AM UTC. This means nearly 90% of the roughly $42 million drained during the exploit two days ago has been recovered.
The hacker’s decision appears to be linked to GMX’s public offer of a 10% bounty for the safe return of the funds. The protocol had set a 48-hour deadline and promised not to pursue legal action against the attacker.
In an on-chain message, the hacker responded simply:
“Ok, funds will be returned later.”
And indeed, they followed through.
Market Reacts to Good News
GMX’s native token, GMX (GMX), surged 16% on the news, partially bouncing back from the 28% plunge it suffered right after the exploit was discovered. While GMX hasn’t formally announced receipt of the funds yet, the team did send a grateful on-chain message to the hacker:
“Thank you, we greatly appreciate this.”
Will the Remaining Funds Come Back?
So far, there’s no word on whether the hacker plans to return the remaining $4.5 million still missing from the exploit.
The GMX incident stands out as one of the largest crypto hacks of the year so far. Other major victims have included Bybit, which was hit for a staggering $1.4 billion in a hack allegedly orchestrated by North Korea’s Lazarus Group, and Cetus Protocol, which lost around $223 million.
Similar to GMX, Bybit also offered a 10% bounty for the return of its funds but has yet to see any of its stolen assets returned.
The GMX hack has become another stark reminder of the risks still haunting the DeFi space. But for now, the partial recovery offers at least a glimmer of relief for the protocol and its community.
