Troves confirms an xWBTC/WBTC vault exploit and pauses three vaults
Troves reports a preliminary loss of about 8.6 BTC from its xWBTC/WBTC vault on Starknet. It says legacy-contract and LST rebalancer permissions were revoked and three vaults paused. Other vaults show no identified impact so far; a final postmortem and recovery remain pending.
- Disclosed
- Oct 31, 2026
- Updated Nov 3, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Troves xWBTC/WBTC depositors on Starknet; xSTRK/STRK and xstrkBTC/strkBTC are also paused as a precaution
- crypto
- In the wild
- Yes
- Troves confirms an exploit and a preliminary loss, not just an unexplained transfer.
What happened
Panda Security attributes the path to a retired rebalancer with surviving vault permissions. Its receipt analysis reports about 6.32 WBTC reaching the sender in the examined transaction; that is not a reconciliation of the approximately 8.6 BTC operator estimate. The researcher leaves the exact vulnerable function and legacy-rebalancer address unconfirmed. Vendor statements describe containment, not a completed audit or restitution.
November 3 source update: The previously inaccessible Ethereum transaction is now readable, including its input data. It was sent on October 31 at 14:49:59 UTC from 0x91926046e148c66869d71B9Fa37306e82DDc8934, the recovery address already identified in Panda Security’s analysis. The message offers return of the remaining funds less 1 WBTC, or the ETH equivalent, to that address by November 3, 2026 at 23:59 UTC. It lists Blockscan Chat, an on-chain reply to that address, and security@troves.fi as contacts, and says confidentiality and legal assurances can be discussed. These are terms in the message, not established immunity or evidence of repayment. The original short public bounty post corroborates the 1 WBTC offer; the message alone cannot verify final losses, broader wallet ownership or a completed refund. Depositors should not send money or sign new approvals to claim this bounty.
Crime-scene timeline
Oct 31, 2026
Troves confirms a vault exploit and an approximately 8.6 BTC preliminary loss
Oct 31, 14:49 UTC
Recovery-wallet transaction records the bounty terms
The on-chain message offers 1 WBTC for return of the remaining assets, or their ETH equivalent, by November 3 at 23:59 UTC. An offer is not evidence of funds returned or legal immunity.
Oct 31, 2026
Operator reports permission revocation, three pauses and a recovery bounty
The visible posts report roughly 40 minutes to revoke permissions and a 1 WBTC offer; the full bounty conditions are not visible in the embed.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Troves incident statement, official public embedPrimaryReadable opening confirms October31 exploit, approximate loss and preliminary scope; later text is truncated.
- Troves containment update, official public embedPrimaryReadable opening reports permission revocation and all three paused vaults; later text is truncated.
- Troves scope clarification, official public embedPrimaryComplete clarification retains preliminary loss and promises verified updates and a postmortem.
- Troves recovery offer, official public embedPrimaryReadable opening confirms a 1 WBTC recovery offer; full terms and recovery-wallet link are truncated.
- Panda Security original transaction analysisPrimaryResearcher reports reading a Starknet receipt and transfer events, publishes six ledger entries and distinguishes observed transfers from the operator loss estimate.
- Recovery-wallet bounty message on EthereumPrimaryReadable transaction input from the recovery address previously identified by Panda Security; terms, deadline and contact channels, not a completed recovery.