TMXTribe: Logic Bug — Mint/Stake/Swap Loop

TMXTribe's GMX fork bled $1.4M through a mint/stake/swap loop for 36 uninterrupted hours — the team had a pause button, multiple security firms flagged it in real time, and nobody pushed it.

Occurred 2026-01-05 Loss $1M Status closed

Summary #

TMXTribe suffered a Perpetuals DEX (GMX fork) on 2026-01-05, resulting in a loss of approximately $1M.

What happened #

TMXTribe's GMX fork bled $1.4M through a mint/stake/swap loop for 36 uninterrupted hours — the team had a pause button, multiple security firms flagged it in real time, and nobody pushed it.

Linked factors #

RD-F-004 — causal : Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
RD-F-111 — causal : Team doxx status — pseudonymous-no-track-record class [via dashboard_risk_factors/Team anonymity: Anonymous — zero public communications post-exploit; team wallets deploying new contracts during exploit]
RD-F-126 — causal : Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — GMX fork]