On October 31, an attacker exploited permissions retained by a legacy rebalancing contract after it had been replaced, resulting in approximately 8.6 BTC in losses from Troves' xWBTC/WBTC vault. Troves revoked the legacy contract's permissions and paused three vaults as a precaution. No impact on other vaults has been identified

On October 31, 2026, Troves (a DeFi protocol on Starknet) had its xWBTC/WBTC vault exploited, resulting in a loss of approximately 8.57 WBTC (about $667,000). The cause was a legacy rebalancing contract that retained permissions after being replaced. The team revoked the permissions, paused affected vaults, and offered a whitehat bounty for fund recovery.