Starknet DeFi Platform Troves Reports xWBTC Vault Exploit, Loss of 8.6 BTC

ChainCatcher report: On October 31, Troves, a DeFi strategy platform on Starknet, announced that its xWBTC/WBTC vault had been exploited, resulting in an initial loss of approximately 8.6 BTC. Troves stated that, based on its investigation as of the time of the post, the exploit was limited to this specific vault, with no evidence of impact on other Troves vaults. The exploit involved an outdated rebalance contract that retained permissions even after being replaced. The team has revoked the contract’s permissions and proactively paused the affected and potentially exposed vaults. They are continuing to assess the full scope of exposure and collaborating with security partners to track the funds and evaluate potential recovery options. Troves later updated that within approximately 40 minutes of detecting the exploit, it revoked the problematic outdated contract and removed all rebalance permissions from its LST vaults. As a precautionary measure, the xWBTC/WBTC, xSTRK/STRK, and xstrkBTC/strkBTC vaults are currently paused. Troves provides automated DeFi strategies on Starknet and plans to publish a detailed post-incident analysis and options for affected depositors once verification is complete.