-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0297
============================================================

Advisory-ID:  0xCERT-2026-0297
Severity:     Medium
Published:    2026-11-01T04:13:20.000Z
Updated:      2026-11-01T08:44:16.067Z
Chains:       Arbitrum, Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0297

Title: Premia options vaults on Arbitrum drained of about $400k-$465k via empty option pools and flash loans

Summary
- -------
An attacker drained about $400k-$465k of collateral from six Premia options vaults on Arbitrum on 2026-11-01 by routing vault collateral into attacker-created option pools. Funds were bridged to Ethereum and swapped to BTC. Premia vault depositors should avoid the affected vaults until Premia confirms a fix.

Details
- -------
Summary
Security firm Blockaid reported an ongoing exploit of Premia Labs' options vaults on Arbitrum at 04:13 UTC on 2026-11-01. Per Blockaid, the attacker created empty option pools, took flash loans and bought options so that vault collateral was locked into those pools, then withdrew it as liquidity. PeckShield put the loss at $464.6K and reported that the exploiter bridged the funds from Arbitrum to Ethereum and swapped them to BTC via Chainflip and NEAR Intents. Premia Labs had not published a statement or post-mortem when this advisory was written.

Affected
- - Premia options vaults on Arbitrum; The Defiant identified six affected vaults (WBTC, WETH and ARB call and put vaults)
- - No fix available at time of publication: a protocol update was reported as expected but has not been confirmed

Impact
Loss estimates differ by source: Blockaid reported about $400.5k drained across about two transactions while the attack was still ongoing; The Defiant estimated about $437,000 in net collateral (3.64410382 WBTC, about 43.47 WETH, 48,479.36 USDC.e and 46,215.43 ARB) from two transactions at 03:15:39 and 03:15:40 UTC, preceded by a setup transaction that created the six option-pool contracts; PeckShield reported $464.6K. According to The Defiant, the affected vaults were left with little directly held collateral. Exploitation in the wild is confirmed. The root cause has not been disclosed by Premia.

Recommended actions
- - Premia vault depositors: do not deposit into or interact with the affected Arbitrum vaults until Premia confirms they are safe; follow only Premia's official channels
- - Exchanges, bridges and swap services: watch for funds linked to the exploit transactions listed in the indicators
- - Beware of follow-on phishing that offers fake refunds or claims

Source & attribution
This 0xCERT advisory summarises Blockaid's alert (https://x.com/blockaid_/status/2116745378674463229), PeckShield's alert (https://x.com/PeckShieldAlert/status/2116758393067340132), and The Defiant's on-chain analysis (https://thedefiant.io/news/hacks/attacker-drains-about-437-000-in-collateral-from-premia-vaults), which identifies the exploit transactions. Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/blockaid_/status/2116745378674463229
- - https://x.com/PeckShieldAlert/status/2116758393067340132
- - https://thedefiant.io/news/hacks/attacker-drains-about-437-000-in-collateral-from-premia-vaults
- - https://arbiscan.io/tx/0x64602cbbeba5d3c7a5e2cff4f98cc118886fc6051c56fa50458abec2c90441ac
- - https://arbiscan.io/tx/0xd7e8086df0570c5389ca27eb9bcdff290e810c094155b410a42e5bad2b3244ff

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrnFLsJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdgnfnkEjtkq7VDG0kFxSb3DHlaD2xwfU2wVu58
RZLD+RYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAKrAEApXIR/E2OQ7xkvOGF
gurq2mTzL6aCz7zlTDBA4QS7ZCMA/1nK4Hub5C/zpQtwR1X7fm1Nnr2w7esL
ZShf6JpuJKEJ
=oh8V
-----END PGP SIGNATURE-----