Starknet DeFi Platform Troves Reports XWBTC Vault Exploit With 8.6 BTC in Initial Losses

Troves, a DeFi strategy platform on Starknet, said its xWBTC/WBTC vault was exploited on October 31, with preliminary losses of about 8.6 BTC. According to ChainCatcher, Troves said its investigation had found no impact on other vaults as of the time of its statement. The exploit involved an older rebalancing contract that retained permissions after being replaced. Troves said it revoked the contract’s permissions within about 40 minutes of discovering the exploit and removed all rebalancing permissions from its LST vault. The team also paused the affected vaults and others that could have been exposed as a precaution. The xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC vaults are currently paused. Troves said it is continuing to investigate the scope of the exposure, track funds with security partners, and assess potential recovery options. The team plans to publish a detailed postmortem and options for affected depositors after verifying the findings.