Vulnerability

A race condition in versions before 1.22.2 let a malicious dapp swap the payload the device signed for the one the user approved. Ledger fixed it quietly two weeks before a researcher went public.

The security firm Hexens published the details of an Aptos Move virtual machine flaw on 4 July. Its simulation showed a 90 per cent success rate at compromising the network with commodity hardware, and about $70 billion in bridge, stablecoin and exchange balances sat within the blast radius.