Back Kucoin

Hexens Discloses and Resolves Move VM Vulnerability on the Aptos Chain

Kucoin • July 5, 2026

The blockchain security firm Hexens disclosed that in February it discovered a vulnerability in the Move VM of the Aptos blockchain, stemming from a caching handling flaw that could lead to type confusion, allowing attackers to theoretically gain high-level privileges over stablecoin minting, cross-chain bridges, and DeFi protocols. Hexens built a simulated environment using a $3,000 server to test the vulnerability, estimating its impact on approximately $250 million in Aptos-native TVL, with a theoretical systemic risk exposure of up to $70 billion. Aptos stated that the exploitability of the vulnerability in real-world conditions is extremely low, and it has been patched through its bug bounty program, with no funds lost.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Aptos Fixes Critical Vulnerability with $70 Billion Risk Exposure Aptos Labs patched a critical vulnerability in its Move virtual machine that could have exposed up to $70 billion in crypto assets. Discovered by Hexens in February 2026, the flaw allowed attackers to manipulate core blockchain data with a low-cost setup of approximately $3,000. The vulnerability, termed a 'stale-cache bug,' was reported through Aptos's bug bounty program and was fixed within hours of disclosure. Simulated attacks achieved a success rate of nearly 90%, raising concerns about the potential for exploitation. No user funds were lost during this incident, and Aptos emphasized the low exploitability of the vulnerability in real-world conditions. The incident highlights the importance of rapid response in blockchain security, especially for high-value networks. The theoretical risk exposure includes critical infrastructure such as stablecoins and cross-chain bridges. 25 sources 61

Extracted Entities

Hexens Discloses and Resolves Move VM Vulnerability on the Aptos Chain

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (1)

Platforms (3)