TMX Protocol Hit by $1.4M Exploit on Arbitrum, Monitored by CertiK

Security researchers at CertiK have detected a sophisticated attack on an unverified contract connected to the TMX decentralized exchange on the Arbitrum network. The incident resulted in approximately $1.4 million in stolen assets, marking another significant breach in the increasingly targeted DEX ecosystem.

The Attack Mechanism Behind the $1.4M Theft

The hacker orchestrated a complex, multi-step attack that leveraged vulnerabilities in how TMX’s smart contract handled liquidity provisioning and token swaps. By repeatedly minting TMX liquidity pool (LP) tokens using USDT collateral, the attacker was able to systematically exploit the contract’s design flaws.

The exploitation flow followed this pattern: the hacker minted TMX LP tokens, staked them to earn rewards, then swapped USDT for USDG stablecoins. After unstaking, they sold large quantities of USDG, creating artificial downward pressure on the token’s price. This coordinated sequence allowed them to extract vast quantities of USDT, wrapped Solana (SOL), and wrapped Ethereum (WETH) from the contract’s reserves.

Why This Attack Succeeded

The unaudited nature of the TMX contract appears to have been a critical vulnerability. Unlike formally verified protocols, unaudited smart contracts lack the rigorous security reviews needed to identify edge cases and exploit vectors. The attacker exploited the contract’s failure to properly validate transaction order and implement sufficient checks on multi-step operations—a common vector in DeFi attacks.

Implications for DEX Security

This incident underscores the persistent risks facing decentralized exchanges, particularly those deployed on Layer 2 networks like Arbitrum. While L2s offer cost advantages, projects sometimes rush to market without complete security audits, leaving users and liquidity providers exposed. CertiK’s monitoring capabilities highlight why on-chain surveillance has become essential for catching these attacks in real-time and protecting the broader ecosystem.

The TMX attack serves as a reminder that even established DEX platforms must prioritize smart contract verification and continuous security monitoring to prevent similar breaches from occurring.