White-Hat Hackers Find Aptos Flaw That Put $70 Billion in Assets at Risk

Aptos is a Layer 1 blockchain launched in 2022 that uses the Move VM to execute smart contracts. Its type and resource-safety mechanisms provide shared infrastructure for on-chain applications. Cybersecurity firm Hexens said the vulnerability could have affected stablecoins, DeFi, cross-chain bridges and exchange gateways, creating theoretical system-wide exposure of up to $70 billion.

Hexens reported the flaw to Aptos through the SEAL 911 emergency channel on February 25, 2026. It simulated attacks using a server costing about $3,000, succeeding in 17 to 18 of 20 tests for a success rate of nearly 90%. Aptos said private validator nodes were patched before a public pull request was deployed on February 27. Hexens disclosed the details on July 4 and confirmed that no users or funds were harmed.