Troves: xWBTC/WBTC vault attacked, initial losses of about 8.6 BTC
BTCFi protocol Troves said in a post on October 31, 2026, that its xWBTC/WBTC vault on Starknet had come under attack, with initial estimated losses of about 8.6 BTC. Troves said that, according to the current investigation, the scope of the attack was limited to that vault, and no impact had yet been found on other Troves vaults.
Troves said the attack involved an old rebalancing contract that had been replaced but still retained permissions. The team has revoked the relevant contract permissions and, out of safety considerations, paused the affected and potentially risky vaults. A later update said that within about 40 minutes after the attack was discovered, all rebalancing permissions on the vulnerable old contract and the LST vaults had been revoked; as a precaution, the xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC vaults are currently paused.
Troves said it is working with security partners to track the stolen funds and assess recovery options, and that it will later publish a detailed postmortem and a handling plan for affected deposit users. The team has sent the attacker a white-hat bounty proposal via an on-chain message, promising to pay 1 WBTC as a reward after the remaining funds are returned; the relevant on-chain information mentioned losses equivalent to about 8.57 WBTC, and the bounty offer is valid until 23:59 UTC on November 3, 2026.
Original source:
Title: We identified an exploit affecting the Troves xWBTC/WBTC vault on October 31... Publisher: Troves (@trovesfi) Publication date: 2026-10-31 URL: https://x.com/trovesfi/status/2116541963755475375 Source nature: directly involved party's original post Verification status: this reading covered the original post and subsequent update post, verification date 2026-11-01 Supported content: attack confirmed, initial losses of about 8.6 BTC, limited to the xWBTC/WBTC vault, old rebalancing contract still retained permissions, permissions revoked and related vaults paused, postmortem to be published later
ABAB AI Insight
Troves is a BTCFi protocol running on Starknet, focused on automated DeFi yield strategies, including LST and liquidity-provision vaults. Its official post confirmed that the incident stemmed from an old rebalancing contract that had been replaced but still retained permissions, a typical smart contract governance issue in which access controls were not fully cleared. About 40 minutes after discovery, the team revoked the relevant permissions and temporarily paused three vaults (xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC) as a precaution, showing a relatively quick response, but the residual permissions on the old contract itself exposed a gap in the upgrade process's permission cleanup.
In an on-chain message, Troves described the initial losses as equivalent to about 8.57 WBTC and offered the attacker a 1 WBTC white-hat bounty, roughly 11%–12% of the losses, on the condition that the remaining funds be returned; the offer is valid until November 3. This kind of public on-chain negotiation and white-hat reward model is not uncommon in DeFi incidents in recent years, but the bounty ratio is relatively conservative; the return address and contact information have been clearly listed in the transaction data. As of verification, there has been no further public confirmation that the funds were returned or that the attacker responded.
Compared with other incidents involving DeFi vaults or rebalancing contracts, this attack relied on permissions not being revoked after replacement, rather than a code logic flaw or oracle manipulation. Similar residual-permission issues have appeared in multiple protocol upgrades and usually create only a brief attack window that can be closed quickly. Troves' current decision to limit the impact to a single vault and proactively pause related vaults helps contain spread, but the preventive pause itself will also temporarily affect funds moving into and out of the related strategies.
This incident changes the direct availability of the Troves xWBTC/WBTC vault and requires the protocol to explain its old-contract cleanup process and user compensation arrangement in the postmortem. Whether the 1 WBTC bounty will lead to a return depends on the attacker's assessment of legal and reputational risks; if the funds are not returned, the protocol will need to assess recovery possibilities through security partners and possible on-chain freezing measures. Points to watch include whether the affected vaults resume, whether the postmortem discloses specific transaction hashes and the reason for the residual permissions, and whether the return address receives funds.
ABAB News · Cognition Law
If a replaced old contract does not have its permissions fully revoked, it can still become an entry point for vault funds to be withdrawn.
Completing permission revocation and preventive pausing within about 40 minutes shows a fast response, but it cannot eliminate the risk created by the residual permissions themselves.
The 1 WBTC white-hat bounty is about 12% of the initial losses, the offer is time-limited, and the return outcome still depends on the attacker's choice.