31 Oct 2026
Troves: Legacy Rebalancer Kept Permissions, ~8.6 BTC Lost From xWBTC Vault
Troves says a replaced rebalancing contract still held permissions and was used to take ~8.6 BTC from its xWBTC/WBTC vault on Starknet. Three vaults paused.
- Event date
- Incident typeSmart-contract exploit (developing)
- Bug classAccess control
- Published
Loss, as sourced
Preliminary loss of approximately 8.6 BTC, limited to the xWBTC/WBTC vault, per Troves (claimed).
Traceability
In brief
Root cause: Per Troves: "a legacy rebalancing contract that retained permissions after being replaced."
Timeline, as sourced: Per Troves: exploit 31 Oct (time not given); permissions revoked within ~40 minutes; disclosure 14:45 UTC; update 17:15 UTC.
Account, as sourced
Claimed (Troves) (post (opens in a new tab)): an exploit affected the xWBTC/WBTC vault on 31 Oct, with a preliminary loss of approximately 8.6 BTC; no impact identified on other vaults. The exploit involved a legacy rebalancing contract that kept its permissions after it was replaced.
Claimed (Troves) (update (opens in a new tab)): within ~40 minutes it revoked the vulnerable legacy contract and every rebalancer permission on its LST vaults, and paused three vaults (xWBTC/WBTC, xSTRK/STRK, xstrkBTC/strkBTC) as a precaution. A postmortem is pending.
Unknown: the transaction, the permission path used, and recovery options for depositors.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/troves-legacy-rebalancer-xwbtc-vault