Internet Money

Magic Internet Money

Tornado Cash

About $13 million worth of cryptocurrency has been drained from decentralized lending protocol Abracadabra.Money following an exploit targeting pools using GMX tokens.
In a March 25 X post, crypto cybersecurity firm PeckShield <a data-ct-non-breakable="null" href="https://x.com/peckshield/status/1904501599848038490" rel="null" target="null" text="null" title="null">reported</a> that contracts related to GMX and Abracadabra.Money had been compromised, resulting in the loss of about 6,260 Ether (<a data-ct-non-breakable="null" href="/ethereum-price" rel="null" target="null" text="null" title="null">ETH</a>), worth around $13 million.
The news follows Abracadabra.Money <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization" rel="" target="_self" text="null" title="https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization">losing $6.49 million</a> after its smart contracts were compromised in late January 2024. At the time, this also led to the protocol’s Magic Internet Money (MIM) stablecoin losing its peg to the US dollar.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/pumpswap-trading-volume-1-billion-pumpfun-memecoin-decline" rel="" target="_self" text="null" title="https://cointelegraph.com/news/pumpswap-trading-volume-1-billion-pumpfun-memecoin-decline">Pump.fun’s new DEX reaches $1B volume a week after launch</a>
<h2 id="gmx-denies-contract-vulnerability">GMX denies contract vulnerability</h2>
Despite initial reports, a pseudonymous GMX communications contributor <a data-ct-non-breakable="null" href="https://x.com/Jonas_ALA/status/1904503131213373642" rel="null" target="null" text="null" title="null">claimed</a> on X that “GMX contracts are not affected.” According to the user, GMX is involved because MIM’s pools are based on GMX v2 pools.
GMX Market (GM) tokens are a core part of the GMX platform, earning fees from swaps and leveraged trading. MIM’s pools, known as <a data-ct-non-breakable="null" href="https://docs.abracadabra.money/learn/intro/cauldrons" rel="null" target="null" text="null" title="null">cauldrons</a>, are the protocol’s core product and provide isolated lending exposure.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lending-protocol-nostra-reports-critical-price-feed-issue" rel="null" target="null" text="null" title="https://cointelegraph.com/news/lending-protocol-nostra-reports-critical-price-feed-issue">DeFi lender Nostra pauses borrowing after price feed error</a>
In an official X post, GMX <a data-ct-non-breakable="null" href="https://x.com/GMX_IO/status/1904509326129238479" rel="null" target="null" text="null" title="null">stated</a> that the hack involved MIM’s pools that used GM tokens. The post further claimed that “no issues have been identified with GMX contracts,” adding:
<blockquote>
 “We believe the issue relates solely to the Abracadabra/Spell cauldrons. These cauldrons allow for borrowing against specific GM liquidity tokens.”
</blockquote>
GMX and Abracadabra.Money had not responded to Cointelegraph’s inquiry by the time of publication.
<h2 id="hackers-use-tornado-cash-bridge-to-ethereum">Hackers use Tornado Cash, bridge to Ethereum</h2>
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-03/0195cd80-b329-78b4-a3c6-11cac1c25960" title="" alt="Abracadabra.Money’s GMX pools hacked, $13M lost">
 <figcaption style="text-align: center;">
 Graphic tracking the hacked funds. Source: <a data-ct-non-breakable="null" href="https://pro.amlbot.com/visualizer/share/mMovWNlUfjJ0tBCbCvLiYw" rel="nofollow noopener" target="_blank" text="null" title="https://pro.amlbot.com/visualizer/share/mMovWNlUfjJ0tBCbCvLiYw">AMLBot</a>
 </figcaption>
</figure>
Crypto forensics firm AMLBot <a data-ct-non-breakable="null" href="https://pro.amlbot.com/visualizer/share/mMovWNlUfjJ0tBCbCvLiYw" rel="nofollow noopener" target="_blank" text="null" title="https://pro.amlbot.com/visualizer/share/mMovWNlUfjJ0tBCbCvLiYw">provided</a> Cointelegraph with a partial reconstruction of how the hack was performed. The hacker’s address was first funded through the Tornado Cash decentralized cryptocurrency mixer, and then those funds were used to pay the transaction fees of the malicious transactions. The stolen ETH was later moved from the Arbitrum network to Ethereum via a blockchain bridge:
<blockquote>
 “The stolen funds, totaling 6,260 ETH, have been transferred from Arbitrum to Ethereum via a bridge.”
</blockquote>
AMLBot’s investigations department also confirmed to Cointelegraph that only Abracadabra.Money contracts were breached as part of the hack. The GMX smart contracts, on the other hand, were not exploited in the malicious transactions, AMLBot added.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/dummies-guide-to-native-rollups-l2s-as-secure-as-ethereum-itself/" rel="" target="_self" text="null" title="https://cointelegraph.com/magazine/dummies-guide-to-native-rollups-l2s-as-secure-as-ethereum-itself/">What are native rollups? Full guide to Ethereum’s latest innovation</a>

Abracadabra.Money’s GMX pools hacked, $13M lost

Table of Contents

Cointelegraph

Other articles published on Mar 25, 2025

BNB Chain Introduces $100M Liquidity Support for Native Tokens Listed on Leading Exchanges

Will Bitcoin’s Recovery Shift Market Dynamics?

Can Ripple (XRP) Turn $1,000 Into $1 Million If It Matches Bitcoin’s (BTC) Market Cap?

Davinci Jeremie Urges Crypto Fans to Invest in Bitcoin Now

Polymarket Boosts User Engagement with Solana

BTFD Offers 2X Free with Code LAUNCH100—Must-Buy Cryptos as FLOKI Rises and NEIRO Endures Turbule...

Join our free newsletter for daily crypto updates!