A type-confusion vulnerability in the Aptos Move virtual machine, disclosed on February 25, 2026, gave attackers a near-90% success rate at bypassing the blockchain's core type-safety guarantees. The exploit infrastructure cost approximately $3,000 — a single well-provisioned server simulating ro...
"It ran as claimed, and the exploit made sense. It required a few conditions to be met, which it seems like they did on the mainnet." — Mudit Gupta, CTO, Polygon
A type-confusion vulnerability in the Aptos Move virtual machine, disclosed on February 25, 2026, gave attackers a near-90% success rate at bypassing the blockchain's core type-safety guarantees. The exploit infrastructure cost approximately $3,000 — a single well-provisioned server simulating roughly one-third of the validator network. No insider access or special permissions were required.
Hexens, the blockchain security firm that discovered the flaw, estimated $70 billion in systemic downstream risk across bridges, cross-chain messaging systems, stablecoin administration flows, and centralized exchange deposit infrastructure. Independent analysis by Grego AI placed Aptos-native assets directly at risk at approximately $250 million. Aptos Labs patched the vulnerability within hours of the emergency disclosure through the SEAL911 white-hat coordination channel. No funds were lost.
The incident raises uncomfortable questions about the Move programming language's security narrative. Move was designed specifically to prevent the class of vulnerability that Hexens exploited — type confusion and unauthorized resource manipulation — through compile-time enforcement and bytecode verification. The fact that a stale-cache bug at the VM layer bypassed these guarantees entirely suggests that language-level safety claims require more scrutiny at the execution-environment level.
Vahe Karapetyan, CTO and co-founder of Hexens, identified the flaw as a "stale-cache bug" in the Aptos Move VM execution environment. The bug created a type-confusion condition — software treating one type of onchain resource as another. In practice, this meant an attacker could manipulate protocol permissions stored as onchain resources: mint rights, bridge controls, and lending market administration capabilities.
The vulnerability operated at the virtual machine layer, beneath the Move language's compile-time safety checks. Move's bytecode verifier, which analyzes smart contracts before deployment to ensure resource-usage rules are followed, did not catch the flaw because it existed in the runtime execution environment rather than in contract logic.
Hexens validated the exploit by demonstrating takeover of "master-minter-style roles using legitimate administration paths," according to CoinDesk's reporting. The researchers stopped short of actual token minting but confirmed the attack could access "bridge capabilities, signer capabilities, master-minter roles, and protocol accounting state."
The Aptos network operates approximately 115 validator nodes across 16 countries, according to data from March 2026. The attack simulation replicated roughly one-third of this validator set using a single server.
The cost-to-damage ratio of this vulnerability is notable for its asymmetry.
Attack infrastructure cost: $3,000 for a well-provisioned server setup that simulated approximately 38 validator nodes (roughly one-third of the network). The actual exploitation, once calibrated, would cost "considerably less," according to Hexens.
Success rate: 17-18 successful attempts out of approximately 20 simulations under real network conditions — a near-90% hit rate.
Requirements: No insider access. No special permissions. No validator status. The attack used what Hexens described as "non-armed calibration techniques" — dry runs measuring mempool and block-construction conditions to optimize timing.
Systemic risk assessment (Hexens): $70 billion. This figure includes value accessible through bridges, cross-chain messaging systems, stablecoin administration flows, and centralized exchange infrastructure connected to Aptos.
Direct risk assessment (Grego AI, independent): Approximately $250 million in Aptos-native DeFi assets.
The dominant attack vector, according to Hexens, ran through centralized exchanges via Aptos bridge pathways — connecting onchain activity to exchange deposit crediting systems. This means the blast radius extended well beyond Aptos-native DeFi protocols to include any exchange or custodian accepting Aptos-bridged assets.
Aptos network market capitalization at the time of disclosure sat in the range of $500 million to $760 million, depending on the data source and methodology. Total value locked in Aptos DeFi protocols had reached approximately $680 million by early 2026, though different tracking platforms report figures ranging from $112 million to $680 million depending on inclusion criteria.
The disclosure and remediation followed the SEAL911 emergency coordination protocol:
An Aptos spokesperson told CoinDesk: "Aptos Labs was notified of a potential issue through our bug bounty program on February 25 that was already being triaged internally at the time. A fix was developed, tested, and deployed to mainnet within hours of discovery. No users or funds were impacted at any point."
SEAL911, operated by the Security Alliance, functions as a 24/7 volunteer emergency hotline connecting security incidents to vetted researchers. The organization also maintains the Whitehat Safe Harbor Agreement, which provides legal protection for white-hat participants in fund rescues.
The specific bug bounty payout amount from Aptos to Hexens has not been publicly disclosed. Aptos's bug bounty program, hosted through HackenProof, lists maximum payouts of up to $250,000 per critical vulnerability.
The Move programming language, developed originally at Meta (then Facebook) for the Diem project and subsequently adopted by Aptos and Sui, was designed around a central value proposition: preventing entire classes of smart contract vulnerabilities through language-level type safety.
Move's resource model prevents assets from being copied, destroyed accidentally, or created from nothing. Its bytecode verifier enforces these rules before deployment. The language supports formal verification techniques for mathematical proofs of code correctness. These properties have been a primary selling point for Move-based chains like Aptos and Sui.
The Hexens disclosure complicates this narrative. The vulnerability existed not in Move contract code but in the Move VM execution environment — the runtime layer that processes Move bytecode on validators. A stale cache in the VM created conditions where Move's type-system guarantees could be bypassed entirely, regardless of how correctly the smart contracts themselves were written.
This distinction matters. Move's safety claims are accurate at the language level: the verifier and resource model do prevent classes of bugs that affect Solidity-based contracts. But the VM layer — where compiled code actually runs — introduces a separate attack surface. A May 2025 academic paper (MoveScanner, arXiv:2508.17964) identified five key categories of Move smart contract vulnerabilities, including resource leaks and weak permission management, noting that "security tools for the Move ecosystem remain underdeveloped compared to other blockchain platforms."
The Sui blockchain, which also uses Move, has faced its own security incidents. In May 2026, the DeepBook protocol on Sui disclosed an undercollateralization vulnerability resulting in $239,700 in bad debt. The $223 million Cetus hack on Sui in May 2025 stemmed from a math overflow bug in application code, not a Move language flaw — but it still occurred within a Move-based ecosystem marketed on safety.
Aptos Labs and Hexens appear to disagree on the practical exploitability of the vulnerability.
Aptos's position, conveyed through a spokesperson to CoinDesk: "The bug would have extremely low exploitability in real world conditions."
Hexens's position: The firm conducted what it described as "probabilistic calibration work" with mainnet-shaped stake distribution and organic transaction traffic, achieving the near-90% success rate under simulated real-network conditions with heavy execution contention.
Mudit Gupta, Polygon's CTO, independently reviewed Hexens's proof-of-concept materials and validated the findings. "It ran as claimed, and the exploit made sense," Gupta told CoinDesk. "It required a few conditions to be met, which it seems like they did on the mainnet."
The disagreement is substantive, not rhetorical. If Aptos's assessment is correct, the vulnerability was a low-priority theoretical concern. If Hexens's calibration data holds, the network was hours from a potential catastrophic exploit when the patch was deployed. The independent review by Polygon's CTO lends weight to the latter interpretation, though the absence of a real-world exploit attempt means no definitive answer exists.
The Aptos vulnerability fits within a broader pattern of escalating blockchain security incidents. According to TRM Labs, H1 2026 recorded 207 crypto security incidents — more than any previous six-month period — resulting in approximately $972 million in total losses. This represents less than half of the roughly $2.3 billion lost in H1 2025, suggesting individual incidents are becoming smaller while frequency increases.
Key H1 2026 security data points:
The Aptos incident is notable because it was caught before exploitation. Most of the H1 2026 statistics represent post-exploitation losses. The Hexens case represents the security model working as intended — responsible disclosure, rapid patching, zero losses — but the attack economics (90% success rate, $3,000 cost) suggest that the window between discovery and exploitation is measured in hours, not days.
A stale-cache bug in the Aptos Move VM gave attackers a near-90% exploit success rate at a cost of approximately $3,000. Hexens estimated $70 billion in systemic downstream risk; independent analysis placed direct Aptos-native risk at $250 million.
The vulnerability bypassed Move's type-safety guarantees entirely. It existed at the VM runtime layer, not in contract logic, complicating the security narrative of Move-based chains.
Emergency response worked. SEAL911 coordination, same-day alerting of downstream projects, and a mainnet patch within hours prevented any losses. No funds were stolen.
Aptos Labs disputes the real-world exploitability. Independent verification by Polygon CTO Mudit Gupta supports Hexens's claims. The disagreement remains unresolved.
H1 2026 recorded 207 hack incidents for $972 million in losses. Infrastructure compromises, not smart contract bugs, accounted for 76% of stolen funds. North Korea-linked actors took 66% of the total.
The Aptos Move VM vulnerability disclosure represents the most significant near-miss in blockchain security since the Wormhole bridge exploit. The attack economics — a sub-$3,000 cost, near-90% reliability, no insider access required — describe a vulnerability class that is practically exploitable, regardless of Aptos Labs's characterization.
The incident carries implications beyond Aptos. Move-based chains have marketed language-level type safety as a differentiator against Solidity-based ecosystems. The Hexens finding demonstrates that VM-layer bugs can render language-level guarantees irrelevant — a reminder that security is a property of the full stack, not any single layer.
For the broader market, the Aptos case illustrates both the fragility and the resilience of existing security infrastructure. SEAL911's emergency coordination and Hexens's responsible disclosure prevented what could have been a significant loss event. But the $3,000 attack cost and 90% success rate imply that the gap between discovery and exploitation continues to narrow. The industry's security posture depends increasingly on white-hat researchers finding these flaws first.