Attacker Drains $437,000 From Six Premia Options Vaults on Arbitrum

An attacker drained approximately $437,000 in net collateral from six Premia options vaults on Arbitrum in two transactions executed one second apart on Oct. 31, according to an on-chain analysis of the transfers by The Defiant. The exploit removed wrapped Bitcoin (WBTC), wrapped Ether (WETH), bridged USDC (USDC.e) and ARB tokens, leaving several of the affected vaults with almost nothing in directly held balances.

The transactions were executed at 11:15:39 p.m. and 11:15:40 p.m. Eastern Time on Oct. 31. The loss figure carries a methodological caveat: analysts computed it from net token outflows using prices displayed by Arbiscan at roughly 12:16 a.m. ET on Nov. 1, not the historical prices at which the assets actually moved. In plain terms, the $437,000 estimate is a snapshot valuation, not a final accounting.

What did the vaults lose?

The combined net outflows across the six vaults totaled 3.64410382 WBTC, approximately 43.47 WETH, 48,479.36 USDC.e and 46,215.43 ARB. That is a modest sum by the standards of major DeFi exploits — for scale, it represents roughly the collateral of a few dozen retail depositors rather than an institutional treasury.

Post-incident snapshots show how thoroughly the vaults were emptied:

• The WBTC call vault held just 0.0008738 WBTC.
• The WETH call vault retained approximately 0.0373 WETH.
• The ARB call vault kept approximately 160.89 ARB.
• The WETH, WBTC and ARB put vaults held approximately 125.73, 88.54 and 45.22 USDC.e, respectively.

These balances reflect only tokens held directly by the vaults after the attack. They do not incorporate the valuation of outstanding option positions, so residual token balances alone cannot establish each vault's full financial position.

Was the attack contained?

Blockchain security firm Blockaid issued an alert at 12:13 a.m. ET on Nov. 1 stating, "Attack still ongoing." That assessment reflected the moment the alert was published; it does not independently confirm the incident continued afterward. Neither Blockaid nor the on-chain record, as reported, establishes whether further draining occurred beyond the two documented transactions.

The transfers were traced using on-chain activity displayed by Arbiscan. The records show collateral moving between Balancer's vault, the Premia vaults, the option pools and the attack contract, with funds returned to Balancer within the same transaction sequence — a signature of flash-loan mechanics.

How did the exploit work?

Premia's underwriter-vault model lets depositors pool collateral to back call and put options; buyers pay premiums and depositors receive shares representing their stake. The operational consequence here is direct: collateral intended to back sold options was extracted, breaking the vaults' capacity to honor their obligations.

According to Blockaid, the attacker created empty option pools, obtained flash loans and purchased options that caused vault collateral to lock inside those pools. The attacker then withdrew that collateral as liquidity, pulling assets out of the affected vaults.

The transaction sequence supports that account. A setup transaction, executed before the two draining transactions, created the six option-pool contracts used in the operation. In the first draining transaction, Balancer's vault transferred WBTC, WETH and USDC.e to the attack contract; the Premia vaults then moved collateral into the option pools, which forwarded tokens to the attack contract before it repaid Balancer.

The link between pool creation, collateral movement and repayment is visible on-chain. What the record does not yet show is a final loss total, any attacker identification, or a response from the Premia team. The $437,000 figure remains an estimate from a single price snapshot, and a fuller accounting — including any additional losses — had not been established at the time of the analysis. Whether Premia issues a post-mortem, pauses deposits or compensates depositors will determine the operational fallout in the days ahead.