A single server costing just $3,000 nearly triggered a crisis threatening $70 billion in crypto assets. Blockchain security firm Hexens revealed a critical flaw in Aptos' Move Virtual Machine that could allow attackers to manipulate core on-chain resources—including stablecoin minting rights, bridge controls, and lending market management—without requiring validator access, insider knowledge, or protocol permissions.
The Flaw: Move VM Cache Bug and Type Confusion
The vulnerability resides in the Aptos Move VM, the execution environment for smart contracts. Hexens described it as a “stale cache error” leading to type confusion—a condition where software can be tricked into treating one type of on-chain resource as another. In Move, protocol permissions (e.g., minting stablecoins, controlling bridges, managing lending markets) are often stored as resources directly on-chain. Compromising them would cascade beyond a single protocol to every entity trusting them.
Hexens CTO and co-founder Vahe Karapetyan led the discovery. He noted that replicating the attack scenario required only a $3,000 server simulating mainnet conditions. A malicious actor would need even less, with no need for validator access or privileged protocol rights.
Aptos Patches, Disputes Practical Exploitability
Aptos received the report on February 25 through its bug bounty program. An Aptos Labs spokesperson told CoinDesk: “An internal evaluation was already ongoing. A fix was developed, tested, and deployed to mainnet within hours. No users or funds were affected.” However, the spokesperson added that the team’s analysis deemed the bug “extremely low exploitability under real-world conditions.”
Independent Verification: PoC Works, Risk Real
Polygon CTO Mudit Gupta independently reviewed Hexens' proof-of-concept and stated: “It worked as described, and the exploit made sense. Some conditions were required, and they appeared met on mainnet.” Another independent verifier, Grego AI, quantified the risk: approximately $250 million in native Aptos TVL was directly exposed (assuming ~90% success rate), while broader cross-chain exposure—including bridges, stablecoins, DeFi protocols, and centralized exchanges—could reach $70 billion.
Hexens researchers analogized the bug to an Ethereum-style flaw allowing attacker-controlled code to write into other contracts' storage, bypassing Move's type system guarantees. Gupta noted that while Aptos acted swiftly, the incident highlights potential fragility in Move's execution environment.