Abracadabra Money GM cauldrons hack — March 2025

The attack ran from 07:57:52 UTC to 09:46:22 UTC on 25 March 2025, ending when Abracadabra cut the affected borrow limits to zero. Roughly $13.4 million of Magic Internet Money (MIM) was borrowed without collateral from five "cauldrons" on Arbitrum that accepted GMX V2 liquidity tokens: gmETH, gmBTC, gmSOL, gmBTC/BTC and gmETH/ETH. The first exploit transaction, at 07:58:06 UTC, minted $44,390 of undercollateralised MIM; the last ran at 09:37:36 UTC.

According to the project's post-mortem, the flaw sat in the GmxV2CauldronV4 contract's collateral accounting. GMX V2 settles deposits in two steps — an order is created, then a keeper fills it — and on liquidation the cauldron drew extra collateral from the router-order contract without marking the user's pending order closed or updating its reported value in collateral terms. The attacker deliberately let a GMX deposit fail so the funds stayed in the OrderAgent contract, borrowed against the position, liquidated himself within the same transaction, and was then able to borrow again against collateral that no longer existed. Halborn describes the same defect as "state tracking errors" in the cauldrons, noting the attacker "could self-liquidate their position and still be able to take out a bad loan using the now non-existent collateral".

Abracadabra said no user collateral was lost and that GMX's own contracts were unaffected, a point a GMX developer confirmed publicly; the shortfall was undercollateralised MIM debt. The contracts had been audited by Guardian Audits. The DAO recovered about $260,000 from the router-order contracts, offered a 20% bounty with an email contact address, and said Chainalysis, ZeroShadow and members of Seal 911 were tracking the funds.

Within roughly 36 hours the treasury, then holding about $19 million, bought back 6.5 million MIM, covering half the loss, and said the remainder would be absorbed over the following months. MIM's peg dipped only slightly, to around $0.9946. Figures for the take vary between about $13 million and $13.4 million depending on whether the MIM borrowed or the roughly 6,260 ETH realised is counted. The ether was bridged to Ethereum; crypto.news reported that around 6,000 ETH was still sitting across three attacker addresses, with the DAO open to negotiating its return. It was not recovered.