A $3,000 Server Exposed a Bug That Put $70B in Crypto at Risk

A server costing $3,000 was enough for blockchain security researchers to simulate an attack path they said could have compromised up to $70 billion in crypto infrastructure. The vulnerability sat in Aptos, a layer-1 blockchain built on the Move language. Hexens, the firm that found it, reported a stale-cache bug leading to a type-confusion flaw in the Move virtual machine. The Aptos team patched it within hours of the Feb. 25 disclosure. No funds were stolen.

Move stores protocol permissions as onchain resources. That includes the rights to mint stablecoins and control bridges. Administering lending markets works the same way. The bug let attacker-controlled code treat one type of onchain resource as another, bypassing the type-system guarantees the language was designed to enforce. The effect was roughly comparable to an Ethereum bug that would let code write into storage belonging to other contracts, Hexens said.

Hexens assessed direct exposure on Aptos at low single-digit billions. Grego AI, which independently verified the proof of concept, calculated that around $250 million in Aptos-native total value locked was directly at risk, based on a near-90% success rate. The broader first-order systemic risk reached roughly $70 billion, Hexens said, including value flowing through bridges and centralized exchanges. The exploit could steal protocol capabilities held by LayerZero, Wormhole, and USDC's cross-chain transfer protocol.