In the meantime, Grego AI, which independently verified Hexens’ proof-of-concept, calculated that roughly $250 million in Aptos-native TVL was immediately in danger primarily based on the near-90% success price, separate from broader cross-chain publicity.
The $70 billion danger
The vulnerability, found by Vahe Karapetyan, CTO and co-founder of Hexens, may, if left unchecked, have uncovered a far bigger systemic danger floor throughout bridges, stablecoins, DeFi protocols and centralized exchanges, costing billions and making a disaster far past Aptos itself.
And all it might’ve taken was just a few thousand {dollars}’ price of servers.
The whole price to spin up the infrastructure wanted to run this experiment was roughly $3,000 for a server that simulated an atmosphere designed to approximate Aptos mainnet situations. Though if a malicious attacker had been to really undergo the exploit, it might have required significantly much less, with out requiring validator entry, insider data or privileged protocol permissions.
The group ran the exploit path roughly 20 instances in a simulated atmosphere and succeeded 17 or 18 instances. The 2 or three failed makes an attempt did not cease the community, which means the attacker may have merely had one other window to strive once more.
The simulation was constructed to intently approximate actual community situations, utilizing a cluster of greater than 30 validator nodes, a mainnet-shaped stake distribution, natural transaction visitors and heavy execution rivalry. The Hexens group additionally examined what they name “non-armed calibration methods”: dry runs that measured mempool and block-construction situations earlier than committing to an armed try. The agency stated these steps materially diminished the uncertainty launched by the exploit’s probabilistic parts, making the assault path extra dependable in observe.