Aptos turns on encrypted mempool on mainnet to curb sandwich attacks

Layer-1 blockchain Aptos has switched on an encrypted mempool on mainnet that hides the contents of pending transactions, the network said in an official blog post on Oct. 12 (local time). The mempool is the queue where transactions wait before being added to a block, and until now anyone could see what was inside it.

Contents stay hidden until the order is set

Until now, what a transaction was buying or selling, and how much, became visible the moment it entered the queue. Bots have exploited that window with sandwich attacks, buying just ahead of a large buy order and selling right after it. Transactions that opt in to the new feature cannot be read until their place in the block is finalized, making that kind of front-running harder. The sender address and the fee remain visible, and the transaction contents are recorded on-chain once the block is final.

The keys to unlock transactions are split among validators. According to Aptos, decryption requires validators holding at least two-thirds of stake, and no single validator or smaller group can do it alone, the same threshold required to produce blocks. The trade-off is roughly 20 milliseconds of extra latency per block in a 50-node benchmark. The implementation was independently reviewed by security firm ZKSecurity.

The feature is specified in Aptos Improvement Proposal AIP-144, created on Jan. 9 this year, which has a status of Accepted. The proposal lists harmful MEV (maximal extractable value) such as front-running and sandwich attacks, along with censorship, as what it aims to curb.

No new party to trust

In the blog post, Aptos compared transaction-protection approaches on other chains in a table, saying the difference comes down to who can read a transaction before it executes.

Aptos said each of the first three approaches brings in a new party to trust, adding that "the Aptos approach requires you to trust only who you were already trusting." It said the batched threshold encryption scheme, which decrypts an entire block at once, is described in a paper currently under submission to the security conference ACM CCS.

Petra first, at twice the gas

Encryption is optional and chosen per transaction. Aptos wallet Petra is the first wallet to offer encryption in its signing screen, and Decibel, a perpetual futures exchange built on Aptos, will use the feature to keep orders private until they execute. Developers can integrate it with the Aptos TypeScript SDK v7.0.0 or later, and existing Move smart contracts need no changes.

It costs more. According to the developer documentation, encrypted transactions have a minimum gas-unit price of 200 octas, twice the base minimum, plus a flat 375 gas-unit decryption charge. Keyless login accounts and some other signers are not yet supported, and Aptos said the feature is live on devnet, testnet and mainnet.

APT down 8% in a day, apart from the news

APT fell along with the broader market after the announcement. With bitcoin sliding to the $81,000 range on the morning of Oct. 13, APT traded at 1,119 won on Upbit and 1,107 won on Bithumb in the Korean won market at 12:32 p.m. KST on Oct. 13. On Binance spot it was at $0.8242, down 8.1% from 24 hours earlier, after touching a low of $0.7613 in that period.

Converted into won, the Binance price was about 1,099 won, putting the kimchi premium (the gap between prices on Korean exchanges and global markets) at about 1.8% on Upbit. The next scheduled funding rate on Binance's APT perpetual futures was -0.011%, meaning short positions were paying longs. Over the past 52 weeks, APT on Upbit hit a high of 5,630 won on Oct. 15, 2025, and a low of 708 won on Aug. 30 this year.