A security flaw in Abracadabra’s smart contracts has led to a major exploit, with a hacker draining around 6,262 ETH—valued at roughly $13 million—from the protocol’s liquidity pools.
The attack, identified as a flash loan exploit, was initially flagged by blockchain security firm PeckShield.
Abracadabra’s lending system, known as “cauldrons,” integrates with GMX liquidity pools to facilitate borrowing and lending. The hacker reportedly manipulated the liquidation process in the GMX V2 integration, exploiting a weakness that allowed them to extract funds from the protocol.
Blockchain researcher Weilin Li analyzed the incident, noting that the attacker used a flash loan to trigger self-liquidation. Flash loans, a DeFi feature allowing users to borrow funds without collateral as long as they are repaid within the same transaction block, played a key role in the exploit.
The attacker borrowed Abracadabra’s stablecoin, Magic Internet Money (MIM), and executed a multi-step strategy to convert the debt into cash, profiting from liquidation incentives.
Despite the breach, a GMX developer confirmed that the attack did not compromise GMX’s core contracts. The stolen funds were later transferred from Arbitrum to Ethereum.
This isn’t the first security incident for Abracadabra. In January 2024, another exploit targeting its MIM stablecoin led to a $6.5 million loss, raising concerns over the protocol’s ongoing vulnerabilities.
The U.S. Department of Justice has sentenced Dwayne Golden, 57, of Pennsylvania to 97 months in prison for orchestrating a fraudulent crypto investment scheme that stole over $40 million from investors.
The first half of 2025 has become the most damaging six-month period in crypto history, with over $2.1 billion stolen across 75+ separate incidents, according to new data.
A new breed of cyber-attack is sweeping through crypto media, exploiting site pop-ups and wallet-connect prompts instead of smart-contract bugs.
CoinMarketCap, one of the most widely used crypto data tracking platforms, is reportedly facing a front-end security breach, with multiple users encountering a suspicious prompt to verify their wallets.