DeFi Trader Nets Over $500K by Using DEX GMX to Manipulate Avalanche Token

GMX developers capped open interest for Avalanche tokens to prevent a repeat of the strategy.

AccessTimeIconSep 19, 2022 at 9:39 a.m. UTC
Updated May 11, 2023 at 6:41 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

A savvy crypto trader deployed millions of dollars to manipulate the prices of Avalanche’s AVAX tokens on the decentralized exchange GMX, taking up to $700,000 in profits by using a strategy that exploited a basic loophole.

GMX, like other decentralized exchanges, or DEXs, relies on smart contracts to match traders between decentralized finance (DeFi) users. Decentralized finance refers to trading activities carried out on a blockchain without the use of a third party.

The exchange allows users to trade spot and perpetual futures using its on-chain trading interface at low fees and has processed more than $45 billion in trading volume since its inception in 2021.

The loophole, however, is that GMX offers trading to users at zero slippage, or the difference between the expected price of a trade and the price at which the trade is executed. But all pricing data on GMX is derived from centralized exchanges, such as Binance or FTX, meaning a trader could buy a large number of tokens, such as AVAX in this case, on zero slippage, rapidly drive up prices on centralized exchanges by placing buy orders on those venues and selling the initial position on GMX at higher prices.

It’s important to note that this strategy won't work on two centralized exchanges, because a trader placing high bids on one venue would mean prices automatically move higher on that exchange and other exchanges immediately raise the price of assets on their own systems – meaning the strategy is unlikely to net any profits.

In several tweets on Sunday, Joshua Lim, head of derivatives at Genesis Global Trading, said the trader exploited the GMX loophole five times, netting over $500,000 to $700,000 in total profits. Security firm PeckShield pegged the gains at $565,000 on Sunday morning in a tweet that’s since been deleted. (Genesis and CoinDesk are both owned by Digital Currency Group.)

The trader put on positions of between $4 million to $5 million each time, Lim said, and extracted over $158,000 in the first trade he did. Lim added that this wasn’t a typical exploit as GMX worked “as designed.”

GMX developers said late Sunday that they were reviewing the loophole and had, in the meantime, capped open interest, or the number of unsettled futures contracts, at $2 million for AVAX on their exchange. A key developer said a solution can be expected in two weeks.

The price of GMX’s native token fell 12% in the past 24 hours amid a broader crypto market decline, extending the token's two-week losses to over 30%, data shows.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.