Premia Labs has suffered an estimated $464,600 cryptocurrency exploit on Arbitrum, with the attacker reportedly moving stolen funds across blockchains before converting them into Bitcoin.
Summary
- PeckShield reported that Premia Labs lost approximately $464,600 in an exploit targeting its options vaults on Arbitrum.
- Blockaid traced the attack to empty options pools, flash loans and transactions that allowed the attacker to withdraw vault collateral.
- The stolen assets reportedly moved from Arbitrum to Ethereum before being converted into Bitcoin through Chainflip and NEAR Intents.
- Independent on-chain analysis identified six affected vaults containing WBTC, WETH, USDC.e and ARB.
- The attack follows several cryptocurrency security incidents involving cross-chain transfers and decentralized trading services.
According to blockchain security firm PeckShield, the attacker transferred the stolen assets from Arbitrum to Ethereum before using Chainflip and NEAR Intents to swap them into BTC. Its November 1 security alert placed the losses at $464,600, equivalent to roughly 131 ETH at the valuation cited in the initial reports.
The incident affected options vaults associated with Premia Labs, the on-chain development company behind the Kyan derivatives platform. Security researchers identified a series of transactions that moved collateral out of the vaults using newly created trading pools.
Premia Labs attacker drains options vaults using flash loans
Blockchain security firm Blockaid first flagged the exploit on November 1, reporting that approximately $400,500 had been drained across two transactions.
Its initial findings described an attacker who created empty options pools, borrowed funds through flash loans and purchased options that caused vault collateral to become locked inside those pools.
The attacker then withdrew the collateral as liquidity, allowing assets originally held in Premia’s vaults to move into attacker-controlled wallets.
Flash loans allow users to borrow cryptocurrency without providing traditional collateral, provided the loan is repaid within the same blockchain transaction.
In this case, Blockaid’s findings indicate that the borrowed funds helped the attacker execute trades that redirected vault assets into pools created for the operation.
The security firm warned that the exploit was ongoing when it published its first findings. Its $400,500 estimate therefore covered the transactions identified at that stage, while PeckShield subsequently reported the larger $464,600 figure.
The affected assets included 3.64 wrapped Bitcoin, approximately 43.47 wrapped Ethereum, 48,479 USDC.e and 46,215 ARB.
According to the transaction records, the two principal withdrawals occurred around 03:15 UTC on November 1, approximately one second apart.
The different loss estimates reflect separate assessments of the incident and should not be treated as additional thefts.
Stolen Premia funds move through Chainflip and NEAR Intents
Once the collateral had left the affected vaults, PeckShield tracked the stolen assets moving from Arbitrum to Ethereum.
The attacker reportedly continued the transfers through Chainflip and NEAR Intents, two services that support cryptocurrency swaps across different blockchain networks.
Chainflip allows users to exchange assets between supported networks without relying on a conventional centralized exchange. NEAR Intents coordinates transactions in which users specify the assets they want to receive.
PeckShield identified Bitcoin as the asset received through the reported conversion route.
The use of multiple services means investigators must follow transactions across separate blockchain networks to establish where stolen assets were sent.
However, the reported transfers do not establish that either platform knowingly assisted the attacker. Neither service has been identified as the source of the Premia vulnerability.
The Premia incident comes amid increased attention on cryptocurrency laundering following the October 29 Binance hack.
As crypto.news previously reported, the Binance attacker moved stolen assets through multiple networks, while token issuers and blockchain investigators worked to freeze funds.
Investigators traced some of those assets into decentralized lending and swapping services, where transactions continued after the initial theft.
The Premia attacker used a different method to obtain funds, with Blockaid identifying options-pool manipulation instead of compromised exchange wallet controls.
Crypto investigators face another cross-chain security incident
The movement of stolen funds through DeFi services has drawn scrutiny following several recent cryptocurrency attacks.
During the Binance incident, investigators identified an attacker-controlled wallet that deposited 60 million USDT into Aave before borrowing approximately 19,762 wrapped ETH.
The borrowing activity prompted Aave’s security guardians to introduce temporary restrictions across several lending markets.
An October 31 investigation into Aave found that the lending protocol itself had not been compromised, although its emergency measures temporarily restricted new deposits and borrowing.
Aave subsequently reopened its affected markets after completing security checks.
Separately, the Binance wallet investigation identified malicious Ethereum authorization transactions that allowed the attacker to redirect funds from a hot wallet.
Those incidents involved different weaknesses, but investigators encountered stolen assets moving between cryptocurrency networks and financial protocols.
The FBI has since urged exchanges, decentralized finance operators and blockchain service providers to block transactions linked to identified attackers from the Binance breach.
Premia Labs had not released a detailed public explanation of the affected vaults, recovery arrangements or any planned reimbursement at the time of the initial security reports.
