In the meantime, Grego AI, which independently verified Hexens’ proof-of-concept, calculated that roughly $250 million in Aptos-native TVL was straight in danger primarily based on the near-90% success charge, separate from broader cross-chain publicity.
The $70 billion danger
The vulnerability, found by Vahe Karapetyan, CTO and co-founder of Hexens, may, if left unchecked, have uncovered a far bigger systemic danger floor throughout bridges, stablecoins, DeFi protocols and centralized exchanges, costing billions and making a disaster far past Aptos itself.
And all it could’ve taken was just a few thousand {dollars}’ value of servers.
The entire value to spin up the infrastructure wanted to run this experiment was roughly $3,000 for a server that simulated an atmosphere designed to approximate Aptos mainnet circumstances. Though if a malicious attacker have been to truly undergo the exploit, it could have required significantly much less, with out requiring validator entry, insider information or privileged protocol permissions.
The workforce ran the exploit path roughly 20 occasions in a simulated atmosphere and succeeded 17 or 18 occasions. The 2 or three failed makes an attempt did not cease the community, that means the attacker may have merely had one other window to attempt once more.
The simulation was constructed to intently approximate actual community circumstances, utilizing a cluster of greater than 30 validator nodes, a mainnet-shaped stake distribution, natural transaction site visitors and heavy execution competition. The Hexens workforce additionally examined what they name “non-armed calibration techniques”: dry runs that measured mempool and block-construction circumstances earlier than committing to an armed try. The agency stated these steps materially diminished the uncertainty launched by the exploit’s probabilistic parts, making the assault path extra dependable in apply.
