Premia options vaults on Arbitrum drained of about $400k-$465k via empty option pools and flash loans

Summary

Security firm Blockaid reported an ongoing exploit of Premia Labs' options vaults on Arbitrum at 04:13 UTC on 2026-11-01. Per Blockaid, the attacker created empty option pools, took flash loans and bought options so that vault collateral was locked into those pools, then withdrew it as liquidity. PeckShield put the loss at $464.6K and reported that the exploiter bridged the funds from Arbitrum to Ethereum and swapped them to BTC via Chainflip and NEAR Intents. Premia Labs had not published a statement or post-mortem when this advisory was written.

Affected

• Premia options vaults on Arbitrum; The Defiant identified six affected vaults (WBTC, WETH and ARB call and put vaults)
• No fix available at time of publication: a protocol update was reported as expected but has not been confirmed

Impact

Loss estimates differ by source: Blockaid reported about $400.5k drained across about two transactions while the attack was still ongoing; The Defiant estimated about $437,000 in net collateral (3.64410382 WBTC, about 43.47 WETH, 48,479.36 USDC.e and 46,215.43 ARB) from two transactions at 03:15:39 and 03:15:40 UTC, preceded by a setup transaction that created the six option-pool contracts; PeckShield reported $464.6K. According to The Defiant, the affected vaults were left with little directly held collateral. Exploitation in the wild is confirmed. The root cause has not been disclosed by Premia.

Recommended actions

• Premia vault depositors: do not deposit into or interact with the affected Arbitrum vaults until Premia confirms they are safe; follow only Premia's official channels
• Exchanges, bridges and swap services: watch for funds linked to the exploit transactions listed in the indicators
• Beware of follow-on phishing that offers fake refunds or claims

Source & attribution

This 0xCERT advisory summarises Blockaid's alert (https://x.com/blockaid_/status/2116745378674463229), PeckShield's alert (https://x.com/PeckShieldAlert/status/2116758393067340132), and The Defiant's on-chain analysis (https://thedefiant.io/news/hacks/attacker-drains-about-437-000-in-collateral-from-premia-vaults), which identifies the exploit transactions. Details may change; refer to the original sources for the authoritative record.