Security researchers from Hexens discovered a vulnerability in the Aptos blockchain that could have exposed up to $70 billion in digital assets, according to a report published on July 4 2026.

The flaw, a stale‑cache type‑confusion bug in the Aptos Move virtual machine, was reported on February 25 and a patch was deployed within hours, the Aptos spokesperson said. No funds were lost and the network remained operational.

Researchers simulated the attack using a server costing about $3,000 that emulated roughly one‑third of the validator set, achieving a success rate of over 90 % across 17 to 18 of 20 test runs. The simulation used more than 30 validator nodes, a mainnet‑shaped stake distribution, and realistic transaction traffic, the team reported.

The Aptos spokesperson disputed the practical exploitability of the bug, stating that analysis determined the issue would have been extremely difficult to exploit in real‑world conditions.

Mudit Gupta, CTO of Polygon, reviewed the proof‑of‑concept material and said the exploit appeared valid under the reported conditions.

Justus Hanna, CEO of Grego AI, which independently verified the simulation, noted that the vulnerability could have allowed theft of protocol capabilities used by bridges such as LayerZero, Wormhole, and USDC’s CCTP.

Grego AI estimated that about $250 million in Aptos native total value locked was directly at risk, while Hexens assessed broader systemic exposure at roughly $70 billion, encompassing bridges, stablecoin administration, DeFi protocols and centralized exchanges.

The same day the report was filed, a volunteer security group called SEAL911 opened an emergency warroom, notified the Aptos development team, and shared proof‑of‑concept material with four downstream projects.

A private‑validator patch was deployed before a public commit was made on February 27, and the Aptos team confirmed that no user funds were impacted at any point.

The incident underscores how hidden bugs in blockchain protocols can pose large‑scale risks, and it highlights the need for continued scrutiny of authority patterns in cross‑chain systems.

The simulation showed that, although no funds were stolen, the potential impact could have dwarfed the $1.5 billion stolen in the Bybit hack of the previous year.