Six Premia Options Vaults on Arbitrum Drained of About $437,000

Two transactions one second apart emptied the collateral from six Premia options vaults on Arbitrum early on Sunday, and the Premia exploit has so far drawn no word from the protocol itself. The attacker took WBTC, wrapped ether, bridged USDC and ARB tokens that depositors had placed in the vaults, at 03:15:39 and 03:15:40 UTC on 1 November.

Security firm Blockaid raised the alarm an hour later. “Blockaid detected an ongoing exploit on @PremiaLabs on Arbitrum,” it posted on X at 04:13 UTC, estimating that “~$400.5k” had been “drained from the vaults so far across ~2 txs”. The Defiant, working from the same transactions, reported a net loss of about $437,000 across six vaults. The gap between the two estimates has not been explained, but the token amounts themselves can be read on the public chain.

How Blockaid says the Premia exploit worked

Blockaid’s description is brief. The attacker “created empty option pools, flash-loaned, and bought options so vault collateral locked into those pools, then withdrew it as liquidity”. A flash loan is a loan borrowed and repaid inside a single transaction, which lets someone act with a large sum for a moment without putting up their own money.

In plain terms, Blockaid is describing a sequence in which the vaults’ own collateral was steered into pools the attacker had just set up, and then taken back out of those pools as if it were the attacker’s liquidity. Blockaid has not said which part of Premia’s code allowed that, and Premia has not published an explanation.

In a follow-up post, Blockaid listed two exploiter addresses on Arbitrum, an externally owned wallet starting 0xbeBa8C and a contract starting 0x577168, along with one example transaction and three of the affected vaults.

What the Arbitrum record shows

TSN read both exploit transactions directly from Arbitrum’s public network. The first is the example Blockaid gave; the second came from the same wallet to the same contract one second later. Both succeeded. Between them, six vault contracts lost tokens, and each names itself on-chain as a Premia “Short Volatility” vault for a call (C) or put (P) strategy.

The totals, 3.64410382 WBTC, about 43.47 WETH, 48,479.36 USDC.e and 46,215.43 ARB, match the breakdown The Defiant published. The dollar value depends on the prices used, which is the likeliest reason the two estimates differ, though neither source has said so.

Blockaid’s 04:13 post said the attack was “still ongoing”. TSN found no further token movements from vaults to either exploiter address after 03:15:40 UTC, up to 06:47 UTC. TSN has not traced where the proceeds went after the second transaction, which swapped and unwrapped part of what was taken.

What Premia vault depositors can check

Premia Labs had posted nothing about the incident on its X account or its website by about 06:50 GMT. The account’s most recent post dates from 8 April, and its posts this year have focused on Kyan, a trading platform it opened in private beta on Arbitrum in March.

Without a statement, depositors cannot know whether the affected vaults have been paused, whether other vaults are at risk, or what happens to their share of the lost collateral. What they can do is check whether they hold shares in any of the six vaults above, using the vault addresses in Blockaid’s thread on a block explorer, and watch Premia’s own channels for instructions.

Incidents like this also bring out impersonators. Anyone offering to “recover” funds, or asking for a seed phrase, a private key, an upfront fee or a wallet signature, is not working for Premia or for any security firm.

Why an unanswered drain leaves depositors guessing

The striking thing about this incident is not its size. Against the Binance theft of more than $6 billion that has dominated the past week, $437,000 is small. What stands out is the silence. About three and a half hours after the transactions, the only public accounts come from a security firm and a news site, while the operator of the vaults has said nothing.

That matters because only the operator can tell depositors how a loss in a shared vault will be handled, whether the contracts can still be used, and whether anything can be recovered. A protocol whose public attention has moved to a newer product, as Premia’s X feed suggests, may also have fewer people watching older contracts. That is an observation about visibility, not a finding about Premia’s security.

The pattern Blockaid describes, where a flash loan lets an attacker borrow heavily for one transaction and use the vaults’ own logic against them, has a familiar shape. TSN reported on 28 October how a flash loan was used to drain about $1.01m from a tranche vault on Avalanche, and Blockaid’s figures also anchored TSN’s account of the zkLink Nova bridge drain. In each case, independent monitors and the public chain told the story first.

For anyone weighing DeFi vaults, the useful test is how quickly an operator speaks, and Blockaid’s own data suggest recovery is the exception: it has said that $287.1m of stolen crypto sits where nobody can freeze it. More incidents are tracked on TSN’s crypto hacks and exploits hub.

What to watch

The next fact that matters is a statement from Premia Labs: whether the vaults are paused, what the cause was and what depositors should do. Until then, the figures rest on Blockaid’s alert, The Defiant’s tally and the transactions themselves.

Sources

• Blockaid on X: exploit alert on Premia, 1 November 2026, 04:13 UTC
• Blockaid on X: exploiter addresses, example transaction and victim vaults, 1 November 2026
• Arbiscan: exploit transaction 0x64602cbb…, 03:15:39 UTC
• Arbiscan: exploit transaction 0xd7e8086d…, 03:15:40 UTC
• Arbiscan: exploiter wallet 0xbeBa8C…
• Arbiscan: exploiter contract 0x577168…
• The Defiant: Attacker Drains About $437,000 in Collateral From Premia Vaults, 1 November 2026
• Premia Labs on X

Related stories

• Attacker Drains $1.01m in USDC From a Tranche Vault on Avalanche
• zkLink Nova Bridge Drained of About $786,000, Blockaid Says
• b14g Says About 97M Staked CORE Was Drained and Pauses Contracts