Aptos Patches Critical Move VM Bug That Put Up to $70 Billion at Risk

Aptos (APT) has patched a critical bug in its Move virtual machine after white-hat researchers warned it could have exposed as much as $70 billion in digital assets to systemic risk, underscoring how smart contract and execution-layer flaws can threaten even fast-growing Layer 1 networks.

According to CoinDesk and security firm Hexens, the issue—described as an ‘expired cache’ vulnerability—was identified in late February and privately reported to the Aptos development team, which deployed a fix soon after. Hexens said the flaw could trigger a type confusion scenario that causes the system to misinterpret on-chain resources, a class of error that can lead to unintended state changes and, in worst cases, asset loss across DeFi applications.

In a simulation designed to approximate real network conditions, the researchers said their exploit success rate exceeded 90%. The team claimed it could replicate roughly one-third of the validator network using a single server costing about $3,000, and that the attack required neither privileged access nor insider permissions. Had it been exploited in the wild, Hexens assessed that major components such as stablecoins and cross-chain bridges could have faced elevated ‘systemic risk’—a point that highlights how interconnected liquidity has become across chains and middleware.

Aptos said it addressed the vulnerability after receiving the report and that no loss of funds occurred.

Separately, South Africa’s revenue authority published a draft cryptocurrency tax guide on July 1 and opened a consultation period through Aug. 31, signaling greater formalization of reporting expectations in one of Africa’s most active crypto markets. The draft classifies crypto as an ‘intangible asset’ rather than foreign currency or legal tender. Unrealized gains on holdings would not be taxed, but disposal events—including swaps—could trigger a tax obligation.

Under the draft, if an individual’s crypto activity is deemed business-like or short-term trading, profits may be treated as ordinary income and taxed at marginal rates of 18% to 45%. Disposals aligned with longer-term investment intent may be treated under capital gains tax rules, with an effective personal tax rate cited at roughly 18% to 36%. The authority also said crypto-to-crypto exchanges would be handled as barter transactions, valued at prevailing local market prices at the time of the swap, and encouraged taxpayers with previously unreported gains to use voluntary disclosure channels.

On flows and positioning, CoinGlass data cited by PANews showed net inflows of 4,932.87 Bitcoin (BTC) to centralized exchanges over the past seven days. Binance accounted for 2,006.76 BTC and OKX for 1,999.85 BTC, while Kraken recorded 848.24 BTC of inflows. Coinbase Pro and Bitfinex, in contrast, posted net outflows of 110.81 BTC and 113.06 BTC, respectively. Market participants often treat exchange inflows as a near-term supply indicator, as coins moved onto trading venues can increase ‘sellable liquidity’—though such flows can also reflect hedging, collateral management, or internal treasury movements.

In Ethereum’s (ETH) ecosystem, co-founder Vitalik Buterin outlined a multi-year ‘Lean Ethereum’ roadmap, according to Wu Blockchain. The plan includes introducing recursive STARKs as a native verification component and replacing cryptography considered vulnerable to quantum computing with ‘quantum-resistant’ alternatives. Buterin also referenced a new ‘scalable state’ model targeting up to 100TB by 2030, with the aim of reducing transaction costs for some tokens to below one-tenth of current levels. For programmable privacy, he is considering virtual machine approaches such as RISC-V or a ‘Lean ISA’ design, and said the planned Glasterdam upgrade could substantially raise Ethereum’s gas limit.

In another sign of convergence between traditional finance exposures and crypto trading infrastructure, Kraken said it will allow eligible users outside the U.S. to post certain tokenized stocks and ETFs as collateral for futures and margin positions. The initial list includes Apple ($AAPL), Nvidia ($NVDA), Tesla ($TSLA), Strategy ($MSTR), SPDR S&P 500 ETF (SPY), and Invesco QQQ Trust (QQQ), among ten supported instruments. Kraken set collateral caps by asset type, with large ETFs eligible up to $1 million, most individual stocks up to $250,000, and tokenized gold and Circle stock up to $100,000—parameters the exchange said may be adjusted as market conditions change.

Notable on-chain activity added to the market’s short-term narrative. Analyst Yu Jin, cited by PANews, reported that a whale continued accumulating from July 1, withdrawing an additional 4,942 ETH and 111.5 Wrapped Bitcoin (WBTC) from Binance. Over four days, the entity reportedly accumulated 24,694 ETH and 211.5 WBTC, valued at approximately $40.26 million and $13.25 million, respectively, with unrealized profits estimated at about $3.61 million.

Meanwhile, Onchain Lens data cited by PANews indicated that Wang Chun, co-founder of mining pool F2Pool, transferred about $63.67 million worth of tokens to Binance over a two-day span. Large transfers to exchanges are frequently monitored for potential selling pressure, though they can also relate to market-making, rebalancing, or custody operations.

Security concerns also resurfaced after CoinSpect said $3.14 million was stolen in the past month from wallet seeds generated with unsafe code—a vulnerability pattern it said has existed since 2018. The firm reported that thousands of such seeds appear to have been used in real-world wallets, with many thefts likely unreported. CoinSpect added that some funds appeared to consolidate into a single address before being laundered, and claimed an additional $2 million moved from an affected address within hours of its warning—though it said it could not confirm whether that transfer was theft-related. The firm also suggested many exposed users may be based in China.

In South Korea, the domestic listing environment showed signs of tightening. Data from the country’s five major exchanges—Upbit, Bithumb, Coinone, Korbit, and Gopax—indicated that net new listings in the first half of 2026 fell to 49, down about 74% from 191 a year earlier, according to local outlet EToday via Odaily. Total new listings were down 44% year over year, while delistings surged 258%, a shift the report linked to weaker volumes, fee pressure, and a strategic pivot from aggressive listing expansion toward ‘liquidity management,’ stricter token screening, and regulatory readiness.

Macro traders are also preparing for policy signals next week, with minutes from both the U.S. Federal Reserve and the European Central Bank due for release. With recent U.S. nonfarm payroll momentum softening and the dollar weakening against major peers, investors are expected to scrutinize the minutes for clues on the forward rate path and the timing of any policy pivot. Key data on the calendar include eurozone producer prices and retail sales, U.S. services PMI and ISM non-manufacturing figures, weekly jobless claims, and remarks from central bank officials including New York Fed President John Williams. The minutes are scheduled for release on Thursday ET.