By cryptoadmin A $3,000 server was enough for a blockchain security researcher to simulate an attack path they say could have put as much as $70 billion in crypto infrastructure at risk.
At the center of the disclosure was a flaw in Aptos, a layer-1 blockchain built on Move, the smart contract language used by Aptos and Sui, that stems from Facebook’s shelved Diem project.
In late February, researchers at the blockchain security firm Hexens reported a critical vulnerability in the Aptos Move virtual machine, the execution environment that processes smart contracts on the chain, to the project’s development team. Hexens identified what it described as a "stale-cache bug" leading to a type-confusion vulnerability, a condition in which software can be tricked into treating one type of onchain resource as another.The
Aptos team did patch the vulnerability when it was flagged, and no funds were lost.
“Aptos Labs was notified of a potential issue through our bug bounty program on February 25 that was already being triaged internally at the time," an Aptos spokesperson told CoinDesk. "A fix was developed, tested, and deployed to mainnet within hours of discovery. No users or funds were impacted at any point."
The Aptos spokesperson also disputed the practical exploitability of the bug to CoinDesk. "Our analysis determined the bug would have extremely low exploitability in real world conditions."
However, the details of what researchers found offer a sobering look at how close the ecosystem came to a potentially industry-altering event.
The sensitivity of this class of bug comes down to how the Move language handles authority. Protocol permissions in Move, including the right to mint a stablecoin, control a bridge, or administer a lending market, are often stored directly as onchain resources. If those resources are compromised, the damage does not stop at one protocol. It extends to everything that trusts them.
Hexens' researchers offered a practical analogy to the bug: it is roughly comparable to a bug on an Ethereum-style chain that would allow attacker-controlled code to write into storage belonging to other contracts, bypassing the type-system guarantees that Move was specifically designed to uphold.
Mudit Gupta, CTO at Polygon, independently reviewed the proof-of-concept materials and said the exploit held up. "It ran as claimed, and the exploit made sense," he told CoinDesk. "It required a few conditions to be met, which it seems like they did on the mainnet."
The vendor was notified hours after the warroom opened, and four major downstream projects were alerted that afternoon, each receiving local-runnable proof-of-concept material and analysis of relevant authority patterns.
A public pull request reflecting the patch became available on February 27. Aptos stated that a private-validator patch had been deployed before the public commit.
Hexens, meanwhile, says it has not received a technical rebuttal or evidence-based argument disputing the demonstrated impact classes. The firm claims that the main concern relayed back to the researchers involved the probabilistic aspects of the exploit, precisely what the team's calibration work was designed to address.
While no funds were stolen, the simulation showed that in a blockchain-level compromise, rate limits, issuer freezes, bridge controls, exchange monitoring and validator patches are not secondary safeguards. They can become the boundary between a contained bug and a market-wide exploit.
HackExclusive 
Latest Crypto News
- 1 Tokenization's next use case is personalized portfolios, NYLIM executive saysil y a 31 minutes
- 2 Bitcoin jumps above $63,000, reversing end-June lossesil y a 2 heures
- 3 Bitcoin experts split over plan to freeze Satoshi's 1.1 million bitcoin as quantum threat growsil y a 2 heures
- 4 Why bitcoin's disconnect from record-high stocks won't lastil y a 4 heures
- 5 Trump's crypto token buyers are down $3.8 billion, blockchain data showsil y a 5 heures
- 6 Europe led on crypto regulation. Now implementation must match ambitionil y a 6 heures
- 7 EU moves to block retail investors from explosive boom of multibillion-dollar prediction marketsil y a 6 heures
- 8 UK's bold new crypto rules promise to unlock global trading, but huge compliance hurdles still threaten the rolloutil y a 8 heures
- 9 XRP climbs 8% as record holder losses signal better risk-reward for buyersil y a 13 heures
- 10 Bitcoin’s next parabolic run may need $1 trillion in fresh capitalil y a 13 heures
Latest Research
Building the Zcash Machine: Tachyon and Quantum Readiness
Building the Zcash Machine: Tachyon and Quantum Readiness
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
By CoinDesk Research Jun 30, 2026 Commissioned byGenZcash
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
Why it matters:
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
View Full Report More From Tech 
Live updates: Bitcoin rises above $62,000 as the red hot semiconductor trade starts to fade
Live updates: Bitcoin holds above $61,000 as momentum stocks plunge to start quarter
