Troves Says Retired Contract Let Attacker Drain 8.6 BTC From Vault

The Troves exploit took about 8.6 BTC from a single vault on Starknet on Friday, after an old rebalancing contract that Troves had already replaced kept the permissions it once held. Troves, which runs automated yield vaults on Starknet, says it revoked those permissions, paused three vaults and is offering the attacker a 1 WBTC bounty to return the rest.

“We identified an exploit affecting the Troves xWBTC/WBTC vault on October 31, resulting in a preliminary loss of approximately 8.6 BTC,” the team posted on X at 14:45 UTC. “Based on our investigation to date, the exploit was limited to this vault, and no impact has been identified on other Troves vaults.”

What Troves says caused the Troves exploit

Troves’ explanation is short. “The exploit involved a legacy rebalancing contract that retained permissions after being replaced,” it said. A rebalancer is the contract that moves a vault’s funds between positions to keep its strategy on track, so it needs the right to act on depositors’ money. Troves’ account is that when it swapped in a new rebalancer, the old one was never stripped of that right.

The transaction can be read on the public record. Troves named it in an on-chain message, and TSN read it from Starknet’s public network: transaction 0x0634…e330 succeeded in block 17,220,375 at 08:25:21 UTC on 31 October, more than six hours before Troves’ first public post. It has been accepted on Ethereum, which Starknet uses for final settlement.

Security researchers have added detail that Troves has not yet confirmed. An advisory from 0xCERT, which relays analysis from DefiLlama and Panda Security, says the attacker used a flash-loan-funded helper contract to “invoke privileged rebalancing on the vault through the retired rebalancer and extract vault assets”. A flash loan is borrowed and repaid within one transaction. Panda Security, which traced the transaction’s transfers, says the helper borrowed exactly 10 WBTC, repaid it near the end and sent about 6.32 WBTC to the attacker’s account in that one transaction; it says the gap to Troves’ 8.57 figure may come from other assets, other transactions or price conversion. The attacker account both firms name matches the sender of the transaction TSN read. DefiLlama’s hacks database records the incident as an access-control failure and puts the loss at about $667,000.

How Troves responded

Troves says it moved quickly once it noticed. “Within ~40 min of the exploit, we revoked the vulnerable legacy contract and every rebalancer permission on our LST vaults,” it said in a later post. As a precaution, three vaults are paused for now: xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC. Founder Akira wrote on X that “no other vaults were affected”.

The team is also trying to get the money back. In an on-chain message sent on Ethereum at 14:49 UTC, Troves said “approximately 8.57 WBTC-equivalent was removed” and offered “a 1 WBTC bounty in exchange for the return of the remaining funds”, to be sent to a named Troves wallet. “The offer is open until 3 November 2026 at 23:59 UTC,” the message says, adding that Troves is “prepared to recognize the return as a whitehat recovery and discuss appropriate confidentiality and legal assurances”.

Troves calls the figure preliminary. In a clarification at 19:00 UTC, it said the loss “appears limited to the xWBTC/WBTC vault” and that “verified updates and the postmortem will come soon”. It has said it will share “information on options for affected depositors”, but has not yet said whether or how they will be repaid.

Why a retired contract kept its keys

The Troves exploit is a small loss by this week’s standards, but it shows a weakness that has nothing to do with clever code. Permissions in DeFi are often granted to a contract address rather than to a function or a version. When a team upgrades by deploying a new contract and pointing the vault at it, the old address keeps whatever rights it was given until someone takes them away. On Troves’ account, that clean-up step was missed, and a contract nobody meant to use still had the power to move a vault’s funds.

That makes this a change-management failure, the same family as the weak points seen elsewhere this week. Swell paused two tokens after rate rises without ETH behind them, in a suspected compromise of its operational keys rather than a code bug, while the b14g and Premia exploits also hit yield products. 0xCERT’s advice to protocol teams is direct: “revoke all roles held by replaced contracts as part of every upgrade or migration”. For depositors, a vault’s audit covers the code it was given, not the permissions left behind after later changes.

The bounty sets a short clock. Troves’ message gives the attacker until 3 November to return the funds less 1 WBTC, a familiar offer in DeFi after an exploit. That is where exchanges, bridges and compliance teams come in: the attacker account and helper contract are now public, and 0xCERT is asking integrators and exchanges to “flag the attacker account and helper contract” and monitor fund movements, so services that screen deposits can treat funds from them as high risk. As with the zkLink Nova bridge exploit two days earlier, the addresses were public within hours. Whether any of the 8.6 BTC comes back will be the first test; the postmortem will be the second. TSN tracks these cases in its crypto hacks and exploits hub.

Sources

• Troves on X: exploit affecting the xWBTC/WBTC vault, 31 October 2026, 14:45 UTC
• Troves on X: 1 WBTC whitehat bounty, 31 October 2026, 14:57 UTC
• Troves on X: permissions revoked, three vaults paused, 31 October 2026, 17:15 UTC
• Troves on X: clarification on the loss, 31 October 2026, 19:00 UTC
• Akira (Troves founder) on X, 31 October 2026, 18:23 UTC
• Etherscan: Troves’ on-chain message and bounty offer, 31 October 2026, 14:49 UTC
• Voyager: Starknet exploit transaction, 31 October 2026, 08:25 UTC
• DefiLlama: hacks database
• 0xCERT advisory 0xCERT-2026-0295
• Panda Security: Troves exploit, a retired rebalancer drained 8.57 WBTC

Related stories

• Six Premia Options Vaults on Arbitrum Drained of About $437,000
• b14g Says About 97M Staked CORE Was Drained and Pauses Contracts
• zkLink Nova Bridge Drained of About $786,000, Blockaid Says