The security firm Hexens published the details of an Aptos Move virtual machine flaw on 4 July. Its simulation showed a 90 per cent success rate at compromising the network with commodity hardware, and about $70 billion in bridge, stablecoin and exchange balances sat within the blast radius.
Hexens published the technical details of a critical Aptos vulnerability on Saturday, five months after quietly reporting it through emergency channels and letting the chain deploy a fix. The bug was a stale-cache condition in the Move virtual machine — the execution environment that runs every smart contract on the network — and Hexens estimated that about $70 billion in on-chain value sat within its blast radius before it was patched.
The disclosure is not that funds were lost. Nothing was drained. What Hexens showed is that the cost of losing them was surprisingly low: a $3,000 server running a well-provisioned simulation of roughly one third of the validator set reliably triggered the exploit with a success rate above 90 per cent. No insider access, no privileged permissions, no stolen keys. A rented box in a commodity data centre would have been enough.
The technical shape of the bug is worth walking through, because it explains why the systemic estimate is so large. The Move VM caches type information about on-chain resources to avoid redundant look-ups. Hexens found a condition in which the cache could be forced to return a stale entry, so that a resource of one type was treated as a resource of a different type — a class of failure known in language theory as type confusion. Once type confusion is available, an attacker can invoke arithmetic on the wrong shape of memory, mint tokens that were never authorised, or read fields on objects that should have been sealed.
The $70 billion figure covers the first-order systemic reach: the value accessible through Aptos-connected bridges, cross-chain messaging systems like LayerZero and Wormhole, the administration flows for USDC's Cross-Chain Transfer Protocol, and balances sitting on the centralised exchanges that use Aptos as a settlement rail. Not all of that value could have been extracted cleanly in a single transaction. But the theoretical envelope is what a systemic bug estimate is for, and the number is the largest figure any independent security review has attached to a single Layer-1 flaw.
Hexens reported the vulnerability to the Aptos Foundation on 25 February. A patched validator client was released within days. The chain never halted; the incident is only visible in the release notes as a security fix without a specific CVE. That the fix landed quickly and silently is the correct outcome — publishing before the patch shipped would have exposed the network to opportunistic attackers with access to the same simulation tooling Hexens had built.
The systemic implication is not that Aptos is uniquely fragile. Most Move-based chains — Sui in particular, which uses a fork of the same VM — went through their own audit cycles after the disclosure. The wider observation is that speed-optimised chains that ship complex execution engines are running attack surfaces that no amount of formal audit language has yet mapped completely. Aptos is fast because it parallelises transaction execution across cores; the same design decisions that make it fast create the caching layers that Hexens learned to abuse.
The Aptos Foundation has not, publicly, disclosed the full timeline of internal review. Nor has it named the bounty amount paid to Hexens. The industry norm for a bug of this severity — with a documented six-figure exploit envelope let alone a $70 billion systemic one — is a payout in the low-to-mid seven figures. Immunefi's largest single bounty on a Layer-1 vulnerability last year was $2.2 million; the Aptos programme's ceiling has been advertised at $1 million.
APT, the network's token, did not react meaningfully to the disclosure. The market had priced in nothing about a bug that no one outside a narrow research circle knew existed, and by the time Hexens published, the fix had been live for four months. That is the desired outcome for a responsible disclosure, and it is also the reason the systemic-risk conversation about Layer-1 execution environments will keep happening in security firms' internal channels rather than in the open. A public race to publish is what the industry avoids by structuring these bounties the way it does.
There is a smaller point buried in the disclosure that deserves attention. Hexens ran the simulation on a single $3,000 server. Every honest post-mortem on a Layer-1 vulnerability in the last three years has landed on the same conclusion — the compute cost of finding a break is dwarfed by the value at stake, and the security models are still calibrated to an era when nation-state actors were the assumed threat. A commodity server running a graduate student's simulation is now sufficient to test the assumption.
The relevant white-hat precedent for large systemic finds is that responsible disclosure gets treated well when the bounty is proportionate and the patch is fast. Both conditions were met here. Whether the bounty was proportionate is a number Aptos has not published.
