GoldPesa (GPXHooks Uniswap v4 hook) hack — October 2026

GoldPesa, a token project on Base, lost about $114,400 from the protocol-owned GPX/USDC liquidity managed by its Uniswap v4 hook, GPXHooks, on 2 October 2026. The attack was a single transaction at 13:05:51 UTC in block 52,078,502. The monitoring service Defimon Alerts reported it the following day, putting the loss at $114K and classifying it as a logic error. GoldPesa has not commented publicly; The Crypto Times said it had asked the project for comment.

According to Defimon, GPXHooks rebalances the project's liquidity inside its beforeSwap function, and any swap can trigger a rebalance once an hour has passed since the last one. The rebalance burns the hook's position through the Uniswap v4 PositionManager and collects the PositionManager's entire net credit, a balance shared by every caller acting within the same PoolManager unlock. The attacker borrowed 175,000 USDC from Morpho and, inside its own unlock, minted a WETH/USDC position through the PositionManager without paying for it, leaving about 115,000 USDC owed. It then swapped on the GPX pool to trigger the rebalance. The hook burned its position for about 148,900 USDC, but because that credit was netted against the attacker's debt it received only about 33,900; in effect the hook paid for the attacker's position, which the attacker then burned for 115,000 USDC before repaying the loan.

This registry read the transaction's token transfers. The attacker's contract received 114,999.9992 USDC from burning its position and 10,428.51 USDC from selling back GPX it had bought for 11,000 USDC in the same transaction, and repaid the 175,000 USDC loan, leaving 114,428.51 USDC, the amount recorded here; the hook received 33,868.60 USDC from its own burn. The attacker swapped the USDC for 96,389 USDT in the same transaction, and Defimon says the USDT was then bridged to Solana and on to BNB Chain. No recovery, bounty offer or statement from GoldPesa has been reported.