Attacker drains $437,000 in collateral from Premia vaults on Arbitrum

On November 1, 2026, Premia Labs suffered an exploit on its Arbitrum options vaults, resulting in an estimated loss of $464,600 across assets including wrapped Bitcoin and Ethereum. Security firms Blockaid and PeckShield reported that the attacker used flash loans to create empty option pools, lock vault collateral, and withdraw liquidity. The funds were bridged to Ethereum and swapped for Bitcoin via Chainflip and NEAR Intents.

Premia Labs vault exploit

• ▪The assets drained in the Premia Labs exploit across six affected vaults included 3.64 wrapped Bitcoin, 43.47 wrapped Ethereum, 48,479 USDC.e, and 46,215 ARB.
• ▪Blockchain security firm Blockaid reported that an initial phase of the Premia Labs exploit drained approximately $400,500 across two transactions around 03:15 UTC on November 1, 2026.
• ▪Premia Labs, the developer behind the Kyan derivatives exchange, suffered an exploit on its options vaults on Arbitrum on November 1, 2026.
• ▪Blockchain security firm PeckShield estimated total losses from the Premia Labs options vault exploit on Arbitrum at approximately $464,600, equivalent to 131 ETH.

Flash loan attack methodology

• ▪The Premia Labs attacker locked vault collateral into fake options pools before withdrawing the assets as liquidity into attacker-controlled wallets.
• ▪An attacker manipulated Premia Labs' options vaults on Arbitrum by using flash loans to buy options in newly created empty trading pools.

Cross-chain fund laundering

• ▪The Federal Bureau of Investigation requested decentralized finance operators help freeze stolen cryptocurrency funds passing through their infrastructure.
• ▪The stolen Premia Labs assets were bridged from Arbitrum to Ethereum before being converted into Bitcoin using cross-chain platforms Chainflip and NEAR Intents.
• ▪Total global cryptocurrency losses from security hacks reached an annual record of $8.73 billion in 2026.

Chainflip NEAR Intents usage

• ▪Blockchain security researchers noted that Chainflip and NEAR Intents limit traceability of transferred funds, though neither service was identified as the source of Premia Labs' vulnerability.
• ▪Cross-chain orchestration platforms Chainflip and NEAR Intents allow users to swap cryptocurrency across separate blockchain networks without conventional centralized exchanges.

North Korean crypto hacking

• ▪North Korean-backed threat group TraderTraitor deployed AI-enabled automated operations to repeatedly rotate stolen cryptocurrency across multiple new addresses and swap venues.
• ▪According to Chainalysis, North Korea-based threat actors accounted for nearly 90% of cryptocurrency hack losses in 2026, up from 15% in 2021.