Hackers breached Abracadabra.Money’s GMX pools, causing a $13 million loss.
A security breach targeted GMX-linked pools and cost Abracadabra $13 million in ETH, but GMX asserts that its smart contracts were not responsible.
Hackers exploited vulnerabilities in pools associated with GMX tokens and drained about $13 million worth of cryptocurrency from Abracadabra.Money.
PeckShield, a crypto cybersecurity firm, disclosed on March 25 via X that an attack on GMX and Abracadabra.Money contracts had drained roughly 6,260 ETH, equating to a $13 million loss.
Before this, a security breach hit Abracadabra.Money in late January 2024 and caused a $6.49 million loss.
The breach caused the Magic Internet Money (MIM) stablecoin to depeg, breaking its tie to the US dollar.
A GMX contributor (@Jonas_ALA) took to X to clarify that “GMX contracts are not affected,” contradicting earlier statements.
Since MIM’s pools are structured around GMX v2 pools, the user believes GMX is linked to the matter.
As an integral part of the GMX platform, GMX Market (GM) tokens earn fees from trading activities, including swaps and leverage.
MIM’s pools, called cauldrons, form the backbone of the protocol and facilitate isolated lending opportunities.
An official GMX post on X stated that the breach involved MIM’s pools that relied on GM tokens.
The post also emphasized, “no issues have been identified with GMC contracts,” adding:
“We believe the issue relates solely to the Abracadabra/Spell cauldrons. These cauldrons allow for borrowing against specific GM liquidity tokens.”
AMLBot, a crypto forensics firm, presented an incomplete step-by-step reconstruction of the hack.
The hacker initially topped up their address through Tornado Cash and then used those funds to cover the costs of the fraudulent transactions.
The hacker later sent the stolen funds from Arbitrum to Ethereum through a bridging protocol.
“The stolen funds, totaling 6,260 ETH, have been transferred from Arbitrum to Ethereum via a bridge.”
AMLBot’s inquiry concluded that the attack compromised only Abracadabra.Money’s contracts but GMX smart contracts remained secure.
