Back Pluang

Aptos patches critical bug risking $70B in asse...

Pluang • July 5, 2026

Aptos discovered a critical stale-cache, type-confusion bug in its Move VM, which was patched within hours after being reported on February 25, 2026. No user funds were lost, and the exploitability on mainnet was very low. The bug posed a serious ris...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Aptos Fixes Critical Vulnerability with $70 Billion Risk Exposure Aptos Labs patched a critical vulnerability in its Move virtual machine that could have exposed up to $70 billion in crypto assets. Discovered by Hexens in February 2026, the flaw allowed attackers to manipulate core blockchain data with a low-cost setup of approximately $3,000. The vulnerability, termed a 'stale-cache bug,' was reported through Aptos's bug bounty program and was fixed within hours of disclosure. Simulated attacks achieved a success rate of nearly 90%, raising concerns about the potential for exploitation. No user funds were lost during this incident, and Aptos emphasized the low exploitability of the vulnerability in real-world conditions. The incident highlights the importance of rapid response in blockchain security, especially for high-value networks. The theoretical risk exposure includes critical infrastructure such as stablecoins and cross-chain bridges. 25 sources 61

Extracted Entities

Platforms (1)

Move Virtual Machine