Here is what the numbers look like: a $3,000 rented server, a near-90% success rate, and potential access to infrastructure carrying $70 billion in assets. That is what security firm Hexens documented in February 2026 and made public on July 4, describing a critical flaw it found in the Aptos blockchain.
The bug lived inside the Move virtual machine — the execution layer that runs smart contracts on Aptos. Hexens called it a stale-cache bug: faulty caching caused the VM to confuse data types, letting attacker-controlled code treat another contract's storage as its own. The researchers compared its severity to an Ethereum bug that allows arbitrary code to write directly into any contract's storage.
The list of reachable targets makes the stakes concrete. Circle's Cross-Chain Transfer Protocol for USDC — which controls minting rights — was accessible. So were the administrative keys for the LayerZero and Wormhole bridges, liquid-staking vaults, and the deposit-crediting pathways at major centralized exchanges. Aptos-native TVL stood at roughly $250 million at the time; counting bridge-connected networks and cross-chain flows, Hexens put the broader systemic exposure at $70 billion.
The attack cost was remarkably low. Hexens ran the simulation on a $3,000 server replicating about one-third of the Aptos validator network. Seventeen or eighteen out of roughly twenty runs succeeded — close to 90%. No special permissions or insider access required.
The firm reported the flaw through emergency channels on February 25. A patch hit the public repository by February 27. No funds were lost — the vulnerability was closed before any attacker could reach it.
The four-month gap between fix and disclosure is standard responsible-disclosure practice: full technical details stay private until the patch is confirmed stable across the network.
For Aptos, the story is uncomfortable even with a clean outcome. The network's security pitch centers on Move, a language built specifically to make whole classes of asset-management bugs structurally impossible. A cache-level flaw in the VM layer hits the foundation, not a user's contract. Sui, Movement, and other Move-based networks run different implementations of the same VM architecture — whether similar caching logic exists there is now an open question for security researchers across the industry.
