Troves xWBTC/WBTC vault on Starknet drained of about 8.57 WBTC via legacy rebalancer that kept vault permissions
On 2026-10-31 an attacker drained about 8.57 WBTC-equivalent (about $667k) from Troves' Ekubo xWBTC/WBTC vault on Starknet through a retired rebalancing contract that still held vault permissions. Troves revoked the permissions and paused affected vaults.
Vuln-watch · relayed from the DeFiLlama hacks database; see Source & attribution below
Summary
On 2026-10-31 (Starknet block 17,220,375, 08:25:21 UTC) Troves' Ekubo xWBTC/WBTC concentrated-liquidity vault on Starknet was exploited. Troves said a legacy rebalancing contract retained permissions over the vault after being replaced. Troves' first update put the loss at about 8.6 BTC; its on-chain message to the attacker states about 8.57 WBTC-equivalent. DefiLlama lists about $667k.
Affected
- Troves (formerly STRKFarm) tEkubo xWBTC/WBTC vault on Starknet; Troves says no other vault was affected
- Troves revoked the legacy contract's access about 40 minutes after discovery, removed rebalancing permissions from its LST vaults and paused the xWBTC/WBTC, xSTRK/STRK and xstrkBTC/strkBTC vaults
Impact
The attacker used a flash-loan-funded helper contract to invoke privileged rebalancing on the vault through the retired rebalancer and extract vault assets. Exploitation in the wild is confirmed. Troves offered a 1 WBTC whitehat bounty open until 2026-11-03 23:59 UTC and said a detailed post-mortem will follow.
Recommended actions
- Do not deposit into paused Troves vaults until Troves confirms they are safe through official channels
- Integrators and exchanges: flag the attacker account and helper contract below and monitor fund movements
- Protocol teams: revoke all roles held by replaced contracts as part of every upgrade or migration
Source & attribution
This 0xCERT advisory summarises Troves' incident statement (https://x.com/trovesfi/status/2116541963755475375), the Troves on-chain message to the attacker reported by Defimon Alerts (https://x.com/DefimonAlerts/status/2116543245211587053), and an on-chain analysis by Panda Security: https://dev.to/pandasecurity/troves-exploit-a-retired-rebalancer-drained-857-wbtc-2009. Details may change; refer to the original source for the authoritative record.
References
Indicators of compromise
All IOC feeds →- address0x13705ea5f9e591ff6ffe3926bf22fceb19317c049838de09750a60259d38c72Troves attacker helper contract — per Panda Security · Starknet
- address0x42dc2ebccae3e55ce3747d2974c801fb3e0facf8d7f4810012a0986a89da5e3Troves attacker account (exploit tx sender) — per Panda Security · Starknet
- tx0x0634307777205294f636d481808a7b9a9e208415a26dd19c8ada269b9332e330Troves exploit tx — named in Troves' on-chain message to the attacker · Starknet
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-31 · last updated 2026-11-01
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0295/signed.txt | gpg --verify