TMX DEX contract on Arbitrum hacked: $1.4 million lost, attacker cleverly exploits minting-staking-exchange cycle

【Crypto World】A serious security incident has occurred on the Arbitrum network. According to CertiK's monitoring data, an unaudited contract associated with the decentralized exchange TMX was hacked, resulting in approximately $1.4 million in losses.

The hacker's tactics are not particularly complicated, but executed very cleverly. They repeatedly perform a set of actions: first mint TMX LP tokens, then stake them to exchange for USDT and other assets, then convert USDT into the USDG stablecoin, and finally unstake and sell large amounts of USDG. Through multiple cycles, the hacker successfully drained USDT, wrapped SOL, and WETH from the contract little by little.

This incident serves as a reminder of how risky unverified DeFi contracts can be. Before participating in any liquidity mining or staking projects, always ensure that the contract has undergone professional security audits.