Track market-moving stories before they get noisy

On April 21, 2026, Coinbase’s Quantum Advisory Council released a position paper naming Aptos and Algorand as the two blockchain networks best positioned to handle the cryptographic challenges that quantum computers will eventually bring. Its advisory group includes Scott Aaronson from UT Austin and Dan Boneh from Stanford University, two of the most cited names in cryptography and quantum computing research.

What makes Aptos different here Most networks today secure wallets using elliptic curve cryptography. A sufficiently powerful quantum computer could, in theory, reverse-engineer private keys from public ones.

Aptos was built with this transition in mind from day one. Launched in 2022, it runs on the Move programming language and uses a modular cryptographic infrastructure. If Aptos needs to swap out its signature scheme, it can do that in a single transaction without asking users to create new accounts or move their assets anywhere.

Advertisement

The Coinbase council’s paper specifically highlighted this crypto-agility as Aptos’s central advantage. Crypto-agility means a system’s ability to swap cryptographic primitives without disrupting the broader network.

In December 2025, the network proposed integrating SLH-DSA, a post-quantum signature scheme that has been formally standardized by the National Institute of Standards and Technology.

Algorand’s approach and why the council cited both Algorand earned its spot in the paper through a different but complementary set of choices. The network has implemented Falcon signatures within its State Proofs, and it offers native key rotation as a built-in feature. Falcon is a lattice-based cryptographic scheme, which is one of the algorithm families that NIST has identified as resistant to quantum attacks.

Researchers from the Ethereum Foundation were also listed among the advisory council’s contributors.

What this means for the market The council’s paper is explicit that immediate threats are not imminent. The point is about preparation time horizons, specifically that the window between “quantum computers become theoretically capable” and “quantum computers become practically deployable” may be shorter than the time required to retrofit major blockchain networks.

Being named in a paper co-authored by cryptographers from Stanford and UT Austin, distributed under Coinbase’s advisory brand, is a different category of validation than a marketing announcement or a partnership press release.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

Aptos just posted its biggest single-day transaction count of the quarter. The Layer-1 blockchain processed over 16 million transactions in a single day in early July, a number that doubles as evidence that its April governance overhaul is doing exactly what it was designed to do.

That governance upgrade was, frankly, a big deal. Aptos raised gas fees tenfold, instituted a hard supply cap of 2.1 billion APT, cut staking rewards, and mandated that 100% of transaction fees be burned. The Aptos Foundation also permanently locked 210 million APT.

The numbers behind the milestone Despite the tenfold gas fee increase, average transaction costs held at $0.0005.

In June 2026, Aptos recorded 83.7 million transactions in a single week, its strongest weekly performance of the year.

Advertisement

The token burn numbers are becoming material. In the 30 days leading up to this report, 235,200 APT were burned. Since the mainnet launched in October 2022, cumulative burns have reached 1.4 million APT.

Monthly emissions from staking sit at roughly 1.6 million APT. The current burn rate is offsetting approximately 15% of that.

Staking rewards were also trimmed as part of the April upgrade, coming down to approximately 2.6%.

Why the governance changes matter beyond the headline The April 2026 upgrades essentially borrowed a page from Ethereum’s EIP-1559 playbook, where base fees are burned rather than paid to validators or a treasury, creating a direct mechanical link between network demand and token supply reduction.

The hard cap of 2.1 billion APT puts a ceiling on total supply that did not exist before. Combined with the Foundation’s decision to permanently lock 210 million APT, the circulating supply trajectory has changed in a way that is difficult to reverse.

Aptos launched its mainnet in October 2022 with a Move programming language and a parallel transaction execution model. The April governance vote addressed the economic side of that equation.

What investors should watch from here Monthly emissions of 1.6 million APT remain higher than the current burn rate, meaning the net supply is still growing. The crossover point, where burns exceed new issuance, depends entirely on sustained or growing transaction volumes.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

Updated Jul 4, 2026, 8:16 p.m. Published Jul 4, 2026, 6:00 p.m.

6 min read

(Boitumelo/Unsplash)Summary

Ethical hackers from security firm Hexens discovered a flaw in the Aptos blockchain that was patched but could have put up to $70 billion in digital assets at systemic risk, including stablecoins and cross-chain bridges.Researchers simulated the attack with a over-90% success rate under real network conditions, using a well-provisioned server setup that cost just $3,000 to simulate about 1/3 of the validator network, and the attack required no insider access or special permissions.The vulnerability was reported through emergency security channels on Feb. 25, and a patch was deployed within days to prevent any funds from being lost.A $3,000 server was enough for a blockchain security researcher to simulate an attack path they say could have put as much as $70 billion in crypto infrastructure at risk.

At the center of the disclosure was a flaw in Aptos, a layer-1 blockchain built on Move, the smart contract language used by Aptos and Sui, that stems from Facebook’s shelved Diem project.

In late February, researchers at the blockchain security firm Hexens reported a critical vulnerability in the Aptos Move virtual machine, the execution environment that processes smart contracts on the chain, to the project’s development team. Hexens identified what it described as a "stale-cache bug" leading to a type-confusion vulnerability, a condition in which software can be tricked into treating one type of onchain resource as another.The

Aptos team did patch the vulnerability when it was flagged, and no funds were lost.

“Aptos Labs was notified of a potential issue through our bug bounty program on February 25 that was already being triaged internally at the time," an Aptos spokesperson told CoinDesk. "A fix was developed, tested, and deployed to mainnet within hours of discovery. No users or funds were impacted at any point."

The Aptos spokesperson also disputed the practical exploitability of the bug to CoinDesk. "Our analysis determined the bug would have extremely low exploitability in real world conditions."

However, the details of what researchers found offer a sobering look at how close the ecosystem came to a potentially industry-altering event.

The sensitivity of this class of bug comes down to how the Move language handles authority. Protocol permissions in Move, including the right to mint a stablecoin, control a bridge, or administer a lending market, are often stored directly as onchain resources. If those resources are compromised, the damage does not stop at one protocol. It extends to everything that trusts them.

Hexens' researchers offered a practical analogy to the bug: it is roughly comparable to a bug on an Ethereum-style chain that would allow attacker-controlled code to write into storage belonging to other contracts, bypassing the type-system guarantees that Move was specifically designed to uphold.

Mudit Gupta, CTO at Polygon, independently reviewed the proof-of-concept materials and said the exploit held up. "It ran as claimed, and the exploit made sense," he told CoinDesk. "It required a few conditions to be met, which it seems like they did on the mainnet."

Meanwhile, Grego AI, which independently verified Hexens' proof-of-concept, calculated that approximately $250 million in Aptos-native TVL was directly at risk based on the near-90% success rate, separate from broader cross-chain exposure.

The $70 billion riskThe vulnerability, discovered by Vahe Karapetyan, CTO and co-founder of Hexens, could, if left unchecked, have exposed a far larger systemic risk surface across bridges, stablecoins, DeFi protocols and centralized exchanges, costing billions and creating a crisis far beyond Aptos itself.

And all it would've taken was a few thousand dollars' worth of servers.

The total cost to spin up the infrastructure needed to run this experiment was approximately $3,000 for a server that simulated an environment designed to approximate Aptos mainnet conditions. Although if a malicious attacker were to actually go through the exploit, it would have required considerably less, without requiring validator access, insider knowledge or privileged protocol permissions.

The team ran the exploit path roughly 20 times in a simulated environment and succeeded 17 or 18 times. The two or three failed attempts didn't stop the network, meaning the attacker could have simply had another window to try again.

The simulation was built to closely approximate real network conditions, using a cluster of more than 30 validator nodes, a mainnet-shaped stake distribution, organic transaction traffic and heavy execution contention. The Hexens team also tested what they call "non-armed calibration techniques": dry runs that measured mempool and block-construction conditions before committing to an armed attempt. The firm said those steps materially reduced the uncertainty introduced by the exploit's probabilistic elements, making the attack path more reliable in practice.

Based on public data collected at the time of reporting, Hexens assessed direct and first-order protocol exposure on Aptos, covering DeFi protocols, tokenized assets, stablecoin infrastructure and liquid-staking systems, at low single-digit billions.

In such exploits, however, the broader risk could've been greater, as blockchain-level compromises rarely stop at the affected chain.

Hexens assessed that the broader first-order systemic risk was approximately $70 billion — a huge number that includes value accessible through bridges, cross-chain messaging systems, stablecoin administration flows and centralized exchanges.

Grego AI noted that the exploit could also be used to steal protocol capabilities, including those held by LayerZero, Wormhole and USDC's CCTP. "If malicious actors had access to this bug, they would have been able to take all [the] TVL that they want[ed]," said Justus Hanna, CEO at Grego AI.

The simulation shows the industry remains vulnerable to hidden bugs in the blockchain technology.

If an attacker had actually found and exploited the bug, in theory, it could have easily dwarfed the massive $1.5 billion stolen in a Bybit hack last year. Most recently, in June, Zcash (ZEC) plummeted 38% after developers revealed a critical bug that had lurked undetected in its privacy pool for four years, one that could have allowed an attacker to print unlimited counterfeit tokens without anyone knowing. Before that, nine-figure bridge hacks and protocol exploits drained liquidity pools and rattled confidence in the infrastructure underpinning the broader market.

It’s worth noting that $70 billion is an estimate based on minting a mammoth amount of USDC stablecoin and using Circle's Cross-Chain Transfer Protocol (CCTP) to move it across chains. If a malicious attacker did this, and given how large the number is, it’s also likely a company like Circle would halt USDC transfers, although that has come under scrutiny recently as the stablecoin issuer said it doesn't freeze assets without legal authorization. So, in theory, if everyone stepped in, the entire $70 billion figure likely wouldn't be achieved—but it would still have rocked the industry nonetheless.

What this proof-of-concept testing demonstrated was access to the kinds of authority that sit at the top of cross-chain systems: bridge capabilities, signer capabilities, master-minter roles and protocol accounting state. Researchers said they validated a takeover of a master-minter-style role and demonstrated the use of a legitimate administration path, stopping short of actually minting tokens but showing why such roles belong in the threat model. The dominant vector into the broader surface runs through centralized exchanges, specifically the Aptos bridge pathways that connect onchain activity to exchange deposit crediting.

Response and disclosureThe same day Hexens filed its report, a "SEAL911" emergency warroom was opened to coordinate the response. SEAL911 is a volunteer security group that has become a key first-responder layer across the crypto ecosystem.

The vendor was notified hours after the warroom opened, and four major downstream projects were alerted that afternoon, each receiving local-runnable proof-of-concept material and analysis of relevant authority patterns.

A public pull request reflecting the patch became available on February 27. Aptos stated that a private-validator patch had been deployed before the public commit.

Hexens, meanwhile, says it has not received a technical rebuttal or evidence-based argument disputing the demonstrated impact classes. The firm claims that the main concern relayed back to the researchers involved the probabilistic aspects of the exploit, precisely what the team's calibration work was designed to address.

While no funds were stolen, the simulation showed that in a blockchain-level compromise, rate limits, issuer freezes, bridge controls, exchange monitoring and validator patches are not secondary safeguards. They can become the boundary between a contained bug and a market-wide exploit.

12345678910

Building the Zcash Machine: Tachyon and Quantum Readiness

Building the Zcash Machine: Tachyon and Quantum Readiness

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Jun 30, 2026

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Why it matters:

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

A Central African nation with a GDP of roughly $12 billion just signed a deal to manage environmental assets potentially worth eight times that figure. The Republic of Chad inked a Memorandum of Understanding with Luxembourg-based Xange.com on June 25, designating the Aptos blockchain as the verification backbone for what could become a $100 billion-plus pipeline of sovereign climate credits.

What the deal actually involves The partnership centers on Xange’s two core products. The first is its digital Monitoring, Reporting, and Verification system, known as dMRV. The second is its Unified Environmental Market Infrastructure Solutions platform, or UEMIS. Together, they’re designed to track, verify, and manage environmental assets at the sovereign level.

The technical mechanism here involves something called Immutable Metadata Digital Certifications, or IMDCs. These are cryptographically verifiable records hosted on the Aptos blockchain, designed to ensure that mitigation data remains auditable and resistant to manipulation.

Aptos was chosen as the verification layer for a straightforward reason: throughput. The blockchain is built for high-speed transaction processing, which matters when you’re trying to manage potentially millions of individual environmental data points across a country spanning over 1.2 million square kilometers.

Advertisement

The Decibel Foundation rounds out the partnership by providing on-chain market infrastructure. An earlier collaboration announced on May 6 between Xange, Aptos Labs, and Decibel established the IMDC standard itself, making this Chad MoU the first major sovereign deployment of that framework.

The $100 billion number, in context The projected pipeline of Internationally Transferable Mitigation Outcomes, or ITMOs, is valued at over $100 billion. ITMOs are essentially the currency of Article 6.2. When Country A reduces emissions beyond its own targets, it can sell those surplus reductions to Country B, which can then count them toward its own Paris Agreement commitments.

For perspective, the global voluntary carbon market was valued at roughly $2 billion in recent years. The compliance market is much larger, but sovereign ITMO trading under Article 6.2 is still in its infancy. A $100 billion pipeline is aspirational. It represents the theoretical ceiling, not a guaranteed outcome.

What this means for investors For the Aptos ecosystem specifically, this partnership adds a layer of real-world utility narrative. Being selected as the verification infrastructure for sovereign-level climate assets is a fundamentally different value proposition than hosting another DeFi protocol or NFT marketplace.

This project is still in its initial phases, focused on deploying infrastructure rather than issuing or trading assets. There’s no immediate revenue generation here. No tokens are being minted against Chad’s forests tomorrow.

Several blockchain projects have positioned themselves in the environmental asset space, including Toucan Protocol on Polygon and KlimaDAO. But sovereign-level partnerships are rare. Most blockchain climate projects operate at the project level, verifying individual reforestation plots or clean energy installations.

Sovereign partnerships carry political risk that project-level deals don’t. Chad ranks among the world’s most fragile states by multiple governance indices. A Memorandum of Understanding is not a binding contract, and the path from MoU to functioning infrastructure to actual ITMO trading is long and uncertain.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

Aptos Foundation, HashKey MENA, and Pan-African infrastructure provider Daya launched a pilot program on June 4 to build a regulated B2B stablecoin payment corridor connecting the MENA region with Africa, with settlement happening natively on the Aptos Layer 1 blockchain.

How the corridor actually works HashKey MENA, which operates under the regulatory oversight of Dubai’s Virtual Assets Regulatory Authority (VARA), anchors the Middle Eastern side of the corridor. On the African end, Daya provides the infrastructure that makes blockchain settlement practical for real-world commerce. Its platform supports fiat on-ramps and off-ramps, including virtual Naira accounts for Nigerian businesses.

Advertisement

The pilot allows corporations to test compliant settlement solutions. The architecture is designed to address high costs, slow processing times, and chronic liquidity shortfalls.

Why this corridor, why now It’s a B2B corridor with licensed entities on both ends, operating within existing regulatory frameworks. Enterprise adoption of stablecoins has consistently been bottlenecked by compliance concerns rather than technical limitations.

Aptos as the underlying settlement layer is a deliberate choice. The blockchain was built with a focus on throughput and low transaction costs. Its Move programming language, originally developed at Meta’s defunct Diem project, was designed with financial applications in mind from the start.

What this means for investors Aptos ecosystem tokens climbed 5.1% following the announcement, pushing the network’s market capitalization to $4.03 billion. Transaction volumes and concrete adoption metrics have not been disclosed.

The risk calculus is straightforward. Pilot programs fail all the time. Regulatory environments in both MENA and Africa can shift quickly. African regulatory frameworks vary dramatically by country, and scaling beyond Nigeria will require navigating a patchwork of compliance regimes.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.