A blockchain that processes billions in daily transactions came dangerously close to a major incident due to a flaw found in its Move virtual machine. Aptos Labs swiftly addressed the critical vulnerability that was discovered by blockchain security firm Hexens. This flaw had the potential to allow attackers to hijack on-chain structures, which could undermine the integrity of the blockchain.
The stale-cache bug was reported by Hexens on February 25, 2026. Within hours, Aptos deployed a fix to its mainnet, followed by a detailed documentation update to its public pull request. This update outlined how the patch related to the company’s ongoing bug bounty program, which incentivizes researchers to report vulnerabilities.
What was the impact of the vulnerability? It allowed for manipulation of core data structures, which define ownership on the blockchain. Hexens researchers demonstrated that for approximately $3,000 in server costs, attackers could execute attempts that had a staggering success rate approaching 90%. They estimated the systemic risk associated with this vulnerability could reach as high as $70 billion, considering the extensive networks of stablecoins, cross-chain bridges, and decentralized finance protocols linked to Aptos. Notably, bridges are at significant risk, as they facilitate transactions across multiple chains and can be vulnerable to exploitations that drain funds from various sources.
Aptos’s response to this incident has been proactive, with no user funds reportedly lost. However, the company has contested claims regarding the real-world exploitability of the bug, arguing that actual practical constraints would make successful attacks more challenging than the simulations suggested. This assertion, however, runs counter to the independent validation provided by Polygon’s CTO, Mudit Gupta, who supported the findings of the researchers.
The public pull request on February 27 not only detailed the technical fix but also reaffirmed the connection to the bug bounty program, which can reward researchers with up to $1 million for critical vulnerability disclosures.
What does this mean for investors and developers? The theoretical $70 billion exposure represents a serious risk, emphasizing the urgency for protocols leveraging Aptos for transactions, particularly cross-chain bridges, to conduct thorough audits of their security frameworks. Given the modest cost of potential exploitation, the findings serve as a critical reminder of the vulnerability landscape.
While Aptos’s bounty program appears competitive, the existence of such a flaw implies that responsible disclosure can be vastly more advantageous than pursuing grey market options, as this particular technical exposure could easily command a higher price in unauthorized channels. As the blockchain ecosystem continues to mature, remaining vigilant against vulnerabilities becomes paramount for ensuring the safety and stability of blockchain technology.