Troves Says Legacy Starknet Rebalancer Left ~8.6 BTC Hole in xWBTC Vault
By Node Zero
October 31, 2026
Troves says a legacy rebalancing contract still trusted after replacement let an attacker drain its xWBTC/WBTC vault on Starknet, with a preliminary loss near 8.6 BTC and three vaults paused while recovery talks open. That unused Orange County protocol beat is tonight’s Dev Pulse file — not another Binance reopen recycle or a Robinhood mint counter.
What the team put on the record. In an October 31 incident thread on @trovesfi, Troves identified an exploit against the Troves xWBTC/WBTC vault that day and put the preliminary loss at about 8.6 BTC. The investigation so far, the project said, limited the hit to that vault and had not found impact on other Troves vaults. The root cause Troves named is blunt protocol hygiene: a legacy rebalancing contract that retained permissions after being replaced. A follow-up said that within roughly 40 minutes of the exploit the team revoked the vulnerable legacy contract and every rebalancer permission on its LST vaults, then paused three products as a precaution — xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC.
What the named Starknet transaction shows without inventing a finished postmortem. Independent reads of Starknet tx 0x0634307777205294f636d481808a7b9a9e208415a26dd19c8ada269b9332e330 on Starkscan show a successful call path that flash-borrows 10 WBTC, routes through Ekubo / router hops involving xWBTC and WBTC, and leaves the sender account with about 6.32 WBTC plus additional xWBTC balance change in that single receipt. Troves’ public figure of ~8.6 BTC / ~8.57 WBTC-equivalent may include assets beyond that one exit print; treat the on-chain receipt as a primary path, not a final accounting, until the project’s postmortem reconciles the difference. The vault chrome on Starkscan labels the product as Troves’ Ekubo xWBTC/WBTC vault at 0x2ea99b4971d3c277fa4a9b4beb7d4d7d169e683393a29eef263d5d57b4380a.
Recovery posture and what is still open. Troves says it is still verifying exposure, tracing funds with security partners, and exploring recovery options, with a detailed postmortem and depositor options promised after verification. Separate incident coverage and on-chain messaging describe a 1 WBTC whitehat bounty for return of remaining funds, timed through November 3, 2026, 23:59 UTC, with a designated Ethereum recovery wallet cited in those reports. Prefer Troves’ own X updates and the Starkscan exploit hash over dollar headlines that convert ~8.6 BTC into a round six-figure USD print without a Troves-signed FX stamp.
Why this lands on Dev Pulse rather than another Rug Room recycle. The instructive failure is upgrade hygiene: granting a new rebalancer role without revoking the old one leaves a trusted path the team no longer reviews. Troves’ own wording — legacy contract retained permissions after replacement, revoke within ~40 minutes, three vaults paused — is the protocol lesson for builders shipping vault strategy upgrades on Starknet or anywhere else that uses role-based rebalancers. This is not the Upland “Troves” collectibles file the desk already covered earlier this month, and it is not a substitute for Binance’s still-pending withdrawal reopen chapter.
What this piece will not invent: a finalized loss in USD, confirmation that every stolen unit sits in one wallet, a claim that other Troves vaults were drained despite the team’s “limited to this vault” statement, or a depositor repayment schedule before Troves publishes one. The hard primaries here are Troves’ ~8.6 BTC preliminary loss, the legacy-rebalancer root cause, the ~40-minute revoke, the three paused vaults, and Starknet tx 0x0634…e330.
Next protocol beat: Watch for Troves’ verified postmortem naming the exact legacy role and function path, whether the 1 WBTC whitehat window through November 3 UTC produces a return, when the paused xSTRK/STRK and xstrkBTC/strkBTC vaults reopen after permission audits, and whether the team publishes depositor remediation terms that match the ~8.6 BTC preliminary print.
Bottom line: Troves says a replaced Starknet rebalancer that still held permissions led to a preliminary ~8.6 BTC hit on its xWBTC/WBTC vault, with three vaults paused and a whitehat recovery window open through November 3 UTC.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
