GoldPesa Exploited for $114,900 via GPXHooks
An attacker exploited vulnerabilities in GoldPesa’s GPXHooks, resulting in a loss of approximately $114,900. The incident involved minting phantom debt and manipulating the rebalancing mechanism.
On October 2, 2026, GoldPesa was targeted by an attacker who exploited its GPXHooks. The vulnerability lay in the PositionManager, which allowed rebalancing through a shared account without verifying that the GPX/USDC currency deltas were zero. The attacker initiated an unlock and minted an unsettled WETH/USDC position, creating about 115,000 USDC of phantom debt. This manipulation enabled the attacker to swap on the GPX pool and trigger the hourly rebalancing process.
As a result of the exploit, the hook’s burn credit was netted against the phantom debt created by the attacker. Subsequently, the attacker burned their own position and withdrew approximately 114,900 USDC from the PoolManager. The specific blockchain on which this incident occurred is not stated, which limits the ability to trace the transaction history directly.
The on-chain record does not provide specific addresses involved in the incident, focusing instead on the mechanism of the exploit itself. This incident highlights the importance of robust checks in smart contract functions to prevent similar vulnerabilities.