TMX Decentralized Exchange Contract Exploited on Arbitrum, $1.4M Drained in Sophisticated Attack

Security monitoring firm CertiK has identified a critical vulnerability exploitation targeting TMX, a decentralized exchange project, on the Arbitrum network on January 6. The incident resulted in the theft of approximately $1.4 million in user assets, exposing significant risks within unaudited smart contract ecosystems.

The Attack Mechanism: How Attackers Drained TMX Liquidity Pools

The exploitation revealed a devastating multi-step attack pattern leveraging TMX’s flawed contract architecture. Threat actors executed a recursive strategy that cycled through several operations: initiating TMX LP token minting with USDT collateral, staking these tokens to generate rewards, then systematically converting USDT into USDG tokens. By unstaking at strategic intervals and repeatedly selling accumulated USDG on secondary markets, attackers progressively exhausted the contract’s reserves.

This cyclical approach proved particularly destructive because each iteration multiplied the attacker’s capital efficiency. Rather than executing a single large withdrawal, the perpetrator fragmented transactions across multiple iterations, making the attack pattern harder to detect until substantial liquidity had already been siphoned off.

Vulnerable Assets and Cross-Token Impact

The breach wasn’t limited to a single asset. The TMX contract held multiple high-value tokens that came under siege: USDT stablecoins, wrapped Solana (SOL), and wrapped Ethereum (WETH). As attackers automated their extraction strategy, they systematically liquidated these diverse holdings, leaving the affected pools severely depleted.

CertiK’s investigation confirmed that the unverified nature of the underlying contracts meant no formal security audit had vetted the code before deployment—a critical oversight that allowed the vulnerability to persist undetected.

Implications for DeFi Security and Future Precautions

The TMX incident underscores a persistent challenge in the decentralized finance sector: the proliferation of unaudited contracts launched without rigorous security vetting. This case demonstrates that even sophisticated attack vectors can succeed when basic safeguards remain absent, serving as a cautionary reminder for projects considering similar tokenomic structures or liquidity mechanisms.