Troves confirms an xWBTC/WBTC vault exploit and pauses three vaults
Troves reports a preliminary loss of about 8.6 BTC from its xWBTC/WBTC vault on Starknet. It says legacy-contract and LST rebalancer permissions were revoked and three vaults paused. Other vaults show no identified impact so far; a final postmortem and recovery remain pending.
- Disclosed
- Oct 31, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Troves xWBTC/WBTC depositors on Starknet; xSTRK/STRK and xstrkBTC/strkBTC are also paused as a precaution
- crypto
- In the wild
- Yes
- Troves confirms an exploit and a preliminary loss, not just an unexplained transfer.
What happened
Panda Security attributes the path to a retired rebalancer with surviving vault permissions. Its receipt analysis reports about 6.32 WBTC reaching the sender in the examined transaction; that is not a reconciliation of the approximately 8.6 BTC operator estimate. The researcher leaves the exact vulnerable function and legacy-rebalancer address unconfirmed. Vendor statements describe containment, not a completed audit or restitution.
Crime-scene timeline
Oct 31, 2026
Troves confirms a vault exploit and an approximately 8.6 BTC preliminary loss
Oct 31, 2026
Operator reports permission revocation, three pauses and a recovery bounty
The visible posts report roughly 40 minutes to revoke permissions and a 1 WBTC offer; the full bounty conditions are not visible in the embed.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Troves incident statement, official public embedPrimaryReadable opening confirms October31 exploit, approximate loss and preliminary scope; later text is truncated.
- Troves containment update, official public embedPrimaryReadable opening reports permission revocation and all three paused vaults; later text is truncated.
- Troves scope clarification, official public embedPrimaryComplete clarification retains preliminary loss and promises verified updates and a postmortem.
- Troves recovery offer, official public embedPrimaryReadable opening confirms a 1 WBTC recovery offer; full terms and recovery-wallet link are truncated.
- Panda Security original transaction analysisPrimaryResearcher reports reading a Starknet receipt and transfer events, publishes six ledger entries and distinguishes observed transfers from the operator loss estimate.