GMX Review: Is Trading Perps Safe After the $42 Million V1 Exploit, and What Does It Cost?

On 9 July 2025 an attacker drained about $42 million from GMX. The protocol is still running, its liquidity pools hold roughly $180 million on Arbitrum and traders keep opening positions. Both facts need explaining before you decide how much trust it deserves.

What actually broke in 2025

The exploit hit GMX V1, the older design built around the GLP vault. Halborn's write-up traces it to a reentrancy flaw in the order execution function: the attacker re-entered a contract before its state updated, pushed down the recorded average short price and inflated the value of GLP. The sting is that the bug came from a fix to an earlier issue, and that fix had not been audited.

The ending was unusual. GMX offered a 10% bounty and a promise not to pursue legal action if funds came back within 48 hours. According to CertiK's analysis, about $37 million was returned in two days and the attacker kept roughly $4 to 5 million as a white-hat reward. GMX said V2, the version the app uses now, and the GMX token were not affected, and coverage at the time repeated that.

So the narrow answer is that V2 was not drained. The wider answer is less comforting: a protocol with years of audits still shipped an unreviewed patch, and any DeFi contract can fail that way. GMX's security page lists audits by Guardian (eight engagements, 88 person-weeks), ABDK, Certora, Dedaub and Sherlock, plus a bounty on Immunefi. That is a serious programme. It is not a guarantee.

Using it

There is no sign-up. You connect a wallet, choose a market and enter margin and size.

gmx.io

The screen is closer to a centralized exchange than most DEXs, with a depth tab, take-profit and stop-loss, limit orders and a liquidation price readout. One difference matters: there is no order book. GMX quotes the oracle index price, and orders are executed by keepers a moment after you submit them. The docs describe trading as powered by GM and GLV liquidity pools, with up to 100x leverage on selected markets.

Oracle pricing has two effects. You are not exposed to book depth, and temporary wicks on a single venue are less likely to liquidate you. In return, slippage protection works against oracle moves in the execution window, with a 1% default you can raise to 5%, and the interface warns above 2%.

The real fee stack

The fee page sets the position fee at 0.04% or 0.06% of size, on opening, closing, increasing and partly reducing. You pay the lower rate if your trade shrinks the gap between long and short open interest, and the higher rate if it widens it. A round trip therefore costs 0.08% to 0.12%, which is fair for a decentralized venue.

That is the headline, not the bill. On top sit these:

• Price impact, which is capped: 0.5% on BTC, ETH, SOL, BNB, BCH and PEPE, and 0.75% to 10% on thinner markets. It can be positive too, so a balancing trade may earn a rebate.

• Borrowing fees, which accrue as long as you hold, and rise with pool utilisation. The docs publish rates for TradFi markets of 45% to 55% APR at full utilisation, which shows how steep they can get.

• Funding fees, which move between longs and shorts depending on imbalance. You may pay or receive.

• Swap fees of 0.05% or 0.07% on ordinary pairs and 0.005% to 0.02% on stablecoin pairs.

• Network fees, since every order is a transaction, plus any bridge cost.

For a trade held an hour, the entry and exit fee dominates. For a leveraged position held for weeks, borrowing and funding can exceed it several times over. Work out the holding period before you compare it with a rival. Our Hyperliquid and dYdX reviews cover the order book alternatives.

Liquidity providers

Anyone can deposit into a GM or GLV pool and act as the counterparty to traders, earning a share of fees. The docs say liquidity providers receive 63% of trading fees. On our visit the pools page showed fee APYs of 5.00% for BTC/USD and 8.08% for ETH/USD, with a TVL near $180 million on the Arbitrum data.

gmx.io

Providing liquidity is not a savings account. Traders win when you lose, and the pool can end up on the wrong side of a trending market. The APY figure above ignores that.

Documentation

The docs are good: current, specific and honest about the formulas. They also cover the GMX Account, which lets you deposit from other chains.

gmx.io

Verdict

GMX is a reasonable place to trade perps without handing your funds to a company, provided you accept smart contract risk and size positions accordingly. Its fees are lower than most centralized exchanges charge for small accounts, but not dramatically so once borrowing and gas arrive. Newcomers should avoid high leverage here, and nobody should keep more in pools or margin than they can lose. This review describes the product and does not recommend any trade.