Aptos's Move type-confusion flaw.

On July 4, Hexens disclosed a flaw in Aptos, a layer-1 blockchain, that it estimates could have put $70 billion across bridges and stablecoins at risk. The bug was reported privately in February and patched before funds moved.

Aptos runs on Move, a language that stores permissions as on-chain objects. The right to mint a stablecoin or control a bridge lives on the ledger as one such object, and Move's type system guarantees one kind cannot be read as another. The flaw let attacker code get the network to read one object as another type, and write to storage it should never reach.

Picture a building where each key is stamped with the one door it opens. This let a holder restamp their key as the master. The cryptography was intact. What failed was the check deciding what each object was allowed to be.

Permissions stored on-chain are only as safe as the rules holding their types honest.