A Starknet vault got drained through a contract its owners had already retired. Nobody took back its keys.
On Oct. 31, an attacker pulled about 8.57 WBTC-equivalent (roughly $667K, per DefiLlama) from Troves' xWBTC/WBTC vault. Troves' explanation: "a legacy rebalancing contract that retained permissions after being replaced." The new rebalancer got the job. The old one kept the badge.
Troves revoked it, stripped every rebalancer permission on its LST vaults and paused three vaults. Its onchain offer to the attacker, keep 1 WBTC and return the rest, expires tonight at 23:59 UTC (6:59 PM ET). The postmortem and "options for affected depositors" are still pending.
The audit covered the code. Nobody audited the exit interview.
Source: TSN