Hexens disclosed that it has patched a major vulnerability in Aptos, with a theoretical risk exposure of up to $70 billion.

According to Mars Finance, on July 5th, blockchain security company Hexens disclosed that it discovered a critical vulnerability in the Aptos Move virtual machine in February of this year, which could theoretically jeopardize approximately $70 billion in crypto assets. However, the Aptos team completed a mainnet patch within hours of the vulnerability disclosure, preventing any user losses. Hexens stated that the vulnerability stems from a "stale-cache" issue in the Move virtual machine, which can lead to type confusion, potentially allowing attackers to gain critical permissions such as stablecoin minting, cross-chain bridges, and DeFi protocols. In simulation tests, the research team achieved an attack success rate of approximately 90% using only a server costing around $3,000, without needing to verify node permissions or internal access rights. Aptos responded that the company quickly completed the patch after receiving the report through its bug bounty program and believes that the vulnerability has extremely low exploitability in a real network environment and will not have any actual impact on users or funds. Hexens believes that if the vulnerability were maliciously exploited, the risks could extend beyond the Aptos ecosystem to include cross-chain bridges, stablecoins, and centralized exchanges. Independent security firm Grego AI estimates that approximately $250 million in TVL on the Aptos chain is directly affected, while the overall theoretical risk exposure could reach as high as approximately $70 billion.