Starknet DeFi Platform Troves Reports XWBTC Vault Exploit With 8.6 BTC in Initial Losses

What happened

Troves, a DeFi strategy platform on Starknet, said its xWBTC/WBTC vault was exploited on October 31 with preliminary losses of about 8.6 BTC. The exploit involved an older rebalancing contract that kept permissions after being replaced.

Confirmed

Global impact / market context

Leftover permissions on a replaced contract let an attacker reach vault funds, showing how smart contract access controls can fail quietly. That can erode depositor trust in DeFi vaults which means pooled crypto deposits managed by code, and raise scrutiny of how platforms retire old contracts.

Analyst inference

DeFi vaults depend on user deposits, so a loss like 8.6 BTC can prompt withdrawals and make investors question similar platforms using rebalancing contracts. For crypto assets broadly, it reinforces that operational and code risks, not only price moves, can affect holdings.

Analyst inference

What to watch

1. Troves said it revoked the old contract's permissions within about 40 minutes of finding the exploit and removed all rebalancing permissions from its LST vault. Confirmed
2. The team plans to publish a detailed postmortem and options for affected depositors after verifying its findings, which means a public report explaining the cause and next steps for users. Proposed
3. Watch whether the paused xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC vaults reopen, and whether recovery efforts return funds, since that shapes depositor losses. Analyst inference

Affected assets

• BTC — Bitcoin

Evidence

• binance.com