A stale-cache bug in Aptos's Move virtual machine, disclosed publicly on July 4, 2026, gave security researchers a near-90% success rate at breaking the chain's core type-safety guarantee for an attack cost of a few hundred dollars. The vulnerability, discovered by blockchain security firm Hexens...
"If malicious actors had access to this bug, they would have been able to take all the TVL that they wanted." — Justus Hanna, CEO, Grego AI
A stale-cache bug in Aptos's Move virtual machine, disclosed publicly on July 4, 2026, gave security researchers a near-90% success rate at breaking the chain's core type-safety guarantee for an attack cost of a few hundred dollars. The vulnerability, discovered by blockchain security firm Hexens on February 25, was patched within hours. No user funds were lost.
Hexens estimated the systemic risk surface at $70 billion, accounting for cross-chain bridges, stablecoin administration flows, and centralized exchange custodial assets connected to the Aptos network. Grego AI, which independently verified the proof-of-concept, calculated $250 million in Aptos-native total value locked (TVL) was directly exploitable. Aptos Labs disputed the real-world exploitability, stating the bug would have had "extremely low exploitability in real world conditions." The incident underscores a structural tension in blockchain security: the gap between controlled-environment exploit success rates and mainnet conditions remains poorly quantified across the industry.
The flaw resided in the Move virtual machine, the execution engine that processes every smart contract on the Aptos blockchain. Hexens classified it as a "stale-cache bug" producing a type-confusion condition — a state in which the VM can be tricked into treating one type of on-chain resource as another.
In practical terms, an attacker exploiting this bug could hijack on-chain structs and authority resources. These are the data structures that define ownership, permissions, and token balances on the network. A successful exploit would allow arbitrary manipulation of who owns what — the most fundamental security guarantee any blockchain provides.
The vulnerability was discovered by Vahe Karapetyan, CTO and co-founder of Hexens. The firm has completed over 300 security engagements with zero client exploits across its portfolio, which includes audits of Lido v2, Polygon zkEVM, and multiple DeFi protocols. Karapetyan is also a member of the Arbitrum Security Council as of March 2026.
The cost-to-impact ratio of this vulnerability was extreme:
| Metric | Value | |--------|-------| | Server infrastructure cost | ~$3,000 | | Per-attempt attack cost | Low hundreds of dollars | | Success rate (simulated environment) | ~90% | | Special permissions required | None | | Insider access required | None | | Network control required | None |
The $3,000 figure represents the cost of a single server capable of simulating an environment approximating Aptos mainnet conditions. Individual exploit attempts within that environment cost in the low hundreds of dollars. No special permissions, insider access, or control over a portion of the validator set was needed — the attack surface was accessible to "any moderately skilled adversary with minimal resources," according to reporting by CoinDesk.
This cost profile matters. In traditional security, high-impact exploits typically require significant capital, specialized hardware, or insider positions. A few-hundred-dollar exploit capable of compromising billions in assets expands the potential attacker pool from nation-state actors and sophisticated criminal organizations to essentially anyone with basic technical competence.
Two independent assessments produced different risk figures, each measuring different things:
Direct Aptos-native risk: ~$250 million. Grego AI, an AI-powered security firm that independently verified Hexens' proof-of-concept, calculated this figure based on Aptos-native TVL directly exploitable given the near-90% success rate. This represents DeFi protocols, liquid staking derivatives, and other smart contract-locked assets on the Aptos chain itself.
Systemic cross-ecosystem risk: ~$70 billion. Hexens' broader estimate accounted for cascading effects through cross-chain bridges, messaging systems, stablecoin administrative flows, and assets custodied by centralized exchanges with Aptos integration. This figure represents not what an attacker could steal in a single transaction, but the total connected value surface that a sustained exploit could disrupt.
For context, Aptos's on-chain TVL stood at approximately $680 million in early 2026, with APT trading at $0.64 — down 96.8% from its all-time high of $19.92. The network's CoinMarketCap ranking was #77 with a market capitalization of approximately $533 million. Mudit Gupta, CTO at Polygon, reviewed the Hexens proof-of-concept and confirmed: "It ran as claimed, and the exploit made sense. It required a few conditions to be met, which it seems like they did on the mainnet."
| Date | Event | |------|-------| | February 25, 2026 | Hexens reports vulnerability via Aptos bug bounty program | | February 25, 2026 (same day) | Aptos Labs begins internal triage | | February 25-26, 2026 | Fix developed, tested, and deployed to mainnet | | February 27, 2026 | Public pull request documents the patch | | July 4, 2026 | Full public disclosure by Hexens |
Aptos's response time — hours from report to mainnet patch — represents the upper end of incident response for Layer 1 protocols. An Aptos spokesperson confirmed: "Aptos Labs was notified of a potential issue through our bug bounty program on February 25 that was already being triaged internally at the time. A fix was developed, tested, and deployed to mainnet within hours of discovery. No users or funds were impacted at any point."
The four-month gap between patch (February 27) and public disclosure (July 4) follows standard responsible disclosure norms for critical vulnerabilities, allowing time for ecosystem participants to update dependencies and for the fix to be independently verified.
Aptos Labs and Hexens disagree on the real-world severity. Aptos stated: "Our analysis determined the bug would have extremely low exploitability in real world conditions." The company argued that mainnet constraints — network latency, validator behavior, mempool dynamics — would have made a successful attack substantially harder than the simulated environment suggested.
Hexens' position, supported by Grego AI's independent verification, is that a 90% success rate in controlled conditions translates to meaningful real-world risk, even if mainnet success rates would be lower. Polygon's CTO Gupta's independent review supported the technical validity of the exploit.
This disagreement highlights a measurement gap across the industry. There is no standardized methodology for translating controlled-environment exploit success rates into mainnet probability estimates. The difference between "extremely low exploitability" and "90% success rate" may be a matter of definitional framing rather than substantive disagreement — but without a shared measurement standard, the industry has no way to adjudicate such disputes.
The Move programming language, originally developed at Meta for the Diem (formerly Libra) project, was designed with formal verification and type safety as core principles. Its resource-oriented programming model was intended to prevent the classes of bugs common in Solidity — reentrancy, integer overflow, and unchecked external calls.
This vulnerability punctures a specific claim: that Move's type system makes certain exploit categories impossible at the language level. The stale-cache bug operated below the language layer, in the VM implementation itself. Move's type-safety guarantees held at the language specification level; the implementation violated them.
Broader data reinforces the point. Academic research published in Cluster Computing (Springer, 2025) identified up to 20,778 vulnerabilities across 37,302 contracts deployed on Aptos and Sui, the two major Move-based chains. Numen Cyber Labs separately discovered VM-level vulnerabilities in both chains that were confirmed and fixed by the respective teams.
Sui, the other major Move-based chain, has experienced its own security challenges. Despite achieving sub-400ms consensus and capturing $2.6 billion in TVL, the network suffered $226 million in DeFi exploits within a five-month period, according to comparative security analyses.
The Aptos bug bounty program offers rewards up to $1 million for critical vulnerability disclosures. The exact bounty paid to Hexens for this finding has not been publicly disclosed.
The broader Web3 bug bounty ecosystem, dominated by Immunefi, now exceeds $162 million in available rewards across more than 400 active programs. Immunefi has facilitated over $115 million in total payouts to date, with its platform protecting over $190 billion in user funds. The Ethereum Foundation quadrupled its maximum bounty from $250,000 to $1 million in March 2025.
Average payouts remain modest relative to the assets protected. According to industry data, the average reward for a critical-severity bug is approximately $13,000, with high-severity bugs averaging $5,300. The overall average including outliers reaches $52,800. These figures raise a structural question: if a critical vulnerability threatening hundreds of millions in TVL earns a five-figure bounty, while exploiting it could yield eight or nine figures, the economic incentive to disclose responsibly relies heavily on legal risk and ethical commitment rather than financial optimization.
Separately, Grego AI — which independently verified the Hexens proof-of-concept — claimed a $250,000 bounty for a separate vulnerability it discovered entirely through AI-driven analysis. That payout, described as the largest bug bounty ever paid for an AI-discovered flaw, signals a new dynamic: autonomous security scanning is entering the bounty market.
The Aptos vulnerability was patched before exploitation, but the broader context is sobering. According to TRM Labs, H1 2026 saw 207 crypto hacking incidents — more than any prior six-month period — though total losses fell to approximately $972 million, down more than 50% year-over-year. CertiK's figures are higher, placing H1 losses at $1.32 billion, down 46.8% year-over-year.
The structural composition of attacks matters more than the aggregate figures:
The Aptos vulnerability falls into the infrastructure-compromise category — a VM-level flaw that, if exploited, would have bypassed all smart-contract-level protections. This category produces the largest losses per incident, and the Aptos case demonstrates why: a single VM bug can invalidate the security properties that every contract on the chain depends upon.
Three structural observations emerge from this incident:
1. Language-level safety claims require VM-level verification. Move's type-safety guarantees are a language-specification property. The stale-cache bug violated those guarantees at the implementation layer. Security audits that evaluate only smart contract code without examining the underlying VM implementation miss the highest-impact attack surface.
2. Cost-to-impact ratios are compressing. A $3,000 exploit infrastructure capable of threatening hundreds of millions in assets represents a secular trend. As AI-driven vulnerability discovery tools like Grego AI mature, the cost of finding critical flaws will continue to fall. The window between vulnerability existence and discovery is shrinking.
3. Bug bounty economics need recalibration. The economic gap between bounty rewards and exploit proceeds creates a structural fragility. When a critical vulnerability threatens $250 million in directly exploitable TVL, the bounty incentive must be sized accordingly — not at an industry average of $13,000.
The Aptos Move VM vulnerability is a case study in how blockchain security actually works versus how it is marketed. Move was designed to eliminate entire categories of bugs through its type system. It does — at the language level. But the VM implementation that executes Move bytecode is still software written by humans, subject to the same implementation bugs as any other complex system.
The incident ended well: Hexens reported responsibly, Aptos responded within hours, and no funds were lost. But the margin of safety was thinner than it appears. A 90% success rate at a few hundred dollars per attempt, accessible without special permissions — this is not a theoretical risk that requires a nation-state adversary. The fact that Hexens found it first, rather than a malicious actor, was a function of the bug bounty program's existence and the firm's decision to audit the VM layer. It was not a function of the bug being hard to find.
The broader Web3 ecosystem should note the structural lesson: infrastructure-layer vulnerabilities — in VMs, consensus implementations, and networking stacks — produce categorically larger losses than smart-contract bugs. Yet the overwhelming majority of security spending and audit attention remains focused on the contract layer. Until that allocation shifts, the highest-impact attack surface will remain the least examined.