Subscribe

GMX V1 GLP Pool Exploit Drains $40 Million

CW28. Circle teams with OKX for zero-fee USD↔USDC conversions and agrees a revenue-share deal with Bybit. GMX’s V1 GLP pool was exploited for $40 million, triggering $500 million in withdrawals and a 10% white-hat bounty. Major stablecoin issuers hold $182.4 billion in U.S. Treasuries.

GMX V1 GLP Pool Exploit Drains $40 Million

Circle partnership with OKX and Bybit

OKX is rolling out zero-fee USDC conversions with USD as part of a new partnership with Circle, the companies announced in a joint statement on Wednesday. Through this partnership, users will now be able to switch directly between dollars and USDC 1:1 without any fees or complex steps.

Meanwhile, Circle has set up a revenue sharing agreement with crypto exchange Bybit, two people familiar told CoinDesk. Although details of the Bybit arrangement are unknown, deals between Circle (CRCL) and exchanges like Coinbase (COIN), and more recently Binance, are to foster adoption of USDC by rewarding these platforms with a portion of the interest on Circle's reserves, and one-off payments in case of Binance.

Circle’s pre-IPO filing revealed that Binance received an up-front fee of $60.25 million from Circle, and continues to receive a monthly incentive based on the percentage of USDC balances on the exchange. Also Circle already shares 50% of the yield from the reserves backing its U.S. dollar-pegged stablecoin with crypto exchange Coinbase.

GMX V1 GLP exploit

The GMX protocol halted trading on GMX V1 after a liquidity pool suffered an exploit on Wednesday, leading to $40 million in funds being stolen and sent to an unknown wallet. GMX V1 is the first version of the GMX perpetual exchange deployed on the Arbitrum network. The attacked pool is a liquidity provider for the GMX protocol with a basket of underlying digital assets, including Bitcoin , Ether and stablecoins, according to the GMX team.

GMX team announced it https://x.com/GMX_IO/status/1942955807756165574. Though the GMX team assured users that v2 smart contracts were not impacted by the exploit, and that the attack was limited to v1 and its GLP pool. GLP acted as the liquidity pool for all trades, but this was modified in v2. Users still believe other funds may still be at risk, and withdrew $500 million liquidity.

Around an hour after the attack, GMX sent an on-chain message to the attacker’s address offering a 10% white-hat bounty for the return of the stolen funds within 48 hours. Then the next day the exploiter returns stolen crypto.

Stablecoin issuers hold $182.4bn in US Treasuries

Four major stablecoin issuers - Tether, Circle, First Digital, and Paxos - collectively hold approximately $182.4 billion in U.S. Treasury assets. This positions them 17th in the U.S. Treasury's "country holders" ranking, surpassing South Korea and the UAE, and just behind Norway's $195.9 billion.

The four of them holds

  • Tether, $125 billion
  • Circle $55.2 billion
  • First Digital $1.3 billion
  • Paxus $0.88 billion

These stablecoin institutions primarily rely on short-term U.S. Treasuries with T+0 settlement to ensure liquidity. With current Treasury yields exceeding 5%, they have become a mainstream asset reserve for stablecoins.


1Token's Service

Serving 60+ Clients worldwide, 1Token's Crypto PMS, RMS, and Portfolio Accounting Software has the unique trading know-how and technology capabilities to build:

  • Front office (portfolio managers and traders) to view live position and exposure, calculate trading PnL and historical performance.
  • Middle office (ops and risk) to maintain portfolios and API accounts, book OTC trades, monitor risk metrics and analyze VaR/STV, generate shadow NAV with investor subscription/redemption/dividend.
  • Back office (admin and auditors) to collect and reconcile trades, generate valuation and PnL reporting under FIFO/WAC tax strategy.