The hacker behind the $42 million GMX exploit drained liquidity from the GLP pool and used the stolen funds to swap USDC into ETH and subsequently DAI, leveraging smart contracts to obscure fund flows.

Quotes that support claims

While a post-mortem of the attack has yet to occur, the hacker appears to have drained GMX's GLP liquidity pool before transferring funds from USDC to ETH and then to the stablecoin DAI, while also stealing millions worth of FRAX, wrapped bitcoin, wrapped ETH, and other cryptocurrencies, onchain data shows.

The hacker proceeded to convert the Ethereum funds into DAI and ETH, further raising alarms.