DeFi Platform Troves on Starknet Reports xWBTC Vault Exploit, Loss of 8.6 BTC

According to Huoxing Finance, on October 31, Troves, a DeFi strategy platform on Starknet, reported that its xWBTC/WBTC vault had been exploited, resulting in an initial loss of approximately 8.6 BTC. Troves stated that, based on its investigation up to the time of the post, the exploit was limited to this specific vault, with no evidence of impact on other Troves vaults. The exploit involved an outdated rebalancing contract that retained permissions even after being replaced. The team has revoked the contract’s permissions and preemptively paused the affected and potentially exposed vaults. They are continuing to assess the scope of exposure and working with security partners to track the funds and evaluate potential recovery options. Troves later updated that within approximately 40 minutes of detecting the exploit, it revoked the problematic outdated contract and removed all rebalancing permissions from its LST vaults. As a precautionary measure, the xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC vaults are currently paused. Troves provides automated DeFi strategies on Starknet and plans to publish a detailed post-mortem analysis and options for affected depositors once verification is complete.