Troves xWBTC/WBTC vault (October 2026) hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 31, 2026 |
| Target type | Stablecoin or yield protocol |
| Loss | $662,247Price at time of incident |
| Method | Access control flawA legacy rebalancing contract kept its permissions over the vault after it had been replaced |
| Chains | Other |
| Outcome | Unresolved |
What happened
On 31 October 2026 an attacker drained the xWBTC/WBTC vault of Troves, formerly STRKFarm, a vault-based yield platform on Starknet whose vault provides concentrated liquidity to the Ekubo xWBTC/WBTC pool. Troves said a legacy rebalancing contract had kept its permissions after being replaced, and that the exploit was limited to that vault.
Troves put the preliminary loss at about 8.6 BTC; its on-chain message to the attacker gives about 8.57 WBTC-equivalent, according to PandaSecurity. At CoinGecko’s 31 October average of $77,275 that is $662,247, or $664,565 for 8.6 BTC. Troves said that within about 40 minutes it revoked the legacy contract and every rebalancer permission on its liquid-staking vaults, and paused three vaults as a precaution.
It offered the attacker a 1 WBTC bounty, open until 23:59 UTC on 3 November, for the return of the rest, and has promised a post-mortem and options for affected depositors.
Sources
- Troves on X (31 October 2026)Primary · retrieved 2026-11-02
- Troves on X: permissions revoked, vaults paused (31 October 2026)Primary · retrieved 2026-11-02
- Troves on X: 1 WBTC bounty (31 October 2026)Primary · retrieved 2026-11-02
- PandaSecurity (1 November 2026)Secondary · retrieved 2026-11-02
Changes to this entry
- Our conversion of Troves’ BTC figures at CoinGecko’s 31 Oct average. Bounty window closes 3 Nov 23:59 UTC; check for a return.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Troves xWBTC/WBTC vault (October 2026) hack — October 2026", iTokenly, accessed 2026-11-02, https://itokenly.com/hacks/troves-xwbtc-vault-october-2026https://itokenly.com/hacks/troves-xwbtc-vault-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.