ABAB News Logo
Back to Flash News

PeckShieldAlert: Premia Labs Suffered an Attack, Losing About $464,600, and the Funds Have Been Bridged and Exchanged into BTC

According to monitoring by security firm Blockaid, Premia Labs’ options vaults on Arbitrum were attacked. The attacker created an empty options pool, used a flash loan to buy options, causing the vault’s collateral to become locked in the relevant pool, and then withdrew the assets in the form of liquidity. Blockaid said that as of its disclosure, about $400,500 in assets had been transferred out of the vault through about two transactions, and the attack was still ongoing at the time.

Analysis by The Defiant of on-chain transfers shows that the attack involved six Premia options vaults (covering calls and puts for WBTC, WETH, and ARB), and that two transactions were executed almost simultaneously at 23:15:39 and 23:15:40 ET on October 31, 2026. Net outflows from the vaults included about 3.64410382 WBTC, about 43.47 WETH, 48,479.36 bridged USDC (USDC.e), and 46,215.43 ARB, valued at about $437,000 based on subsequent prices. The collateral directly held by the affected vaults was significantly reduced.

PeckShieldAlert monitored that Premia Labs was exploited, with losses of about $464,600. The attacker has bridged the stolen funds from Arbitrum to Ethereum, and then exchanged them into BTC through Chainflip and NEAR Intents. As of this verification, no official response statement from Premia Labs regarding this incident has been found.

Original sources:

  1. Title: 🚨Blockaid detected an ongoing exploit on @PremiaLabs on Arbitrum. Publisher: Blockaid (@blockaid_) Date: 2026-11-01 URL: https://x.com/blockaid_/status/2116756274255675582 Nature of source: direct post by the party involved Verification status: the full original post was read for this report (including follow-up thread clues), verification date 2026-11-01 Supporting details: attack mechanism (empty options pool, flash-loan purchase of options to lock collateral, then withdrawal of liquidity), about $400,500 transferred out through about two transactions, attack was still ongoing at the time

  2. Title: Attacker Drains About $437,000 in Collateral From Premia Vaults Publisher: The Defiant Team Date: 2026-11-01 URL: https://thedefiant.io/news/hacks/attacker-drains-about-437-000-in-collateral-from-premia-vaults Nature of source: media report Verification status: the visible content on the page and the on-chain analysis summary were read for this report, verification date 2026-11-01; loading of the full long article was limited Supporting details: six vaults affected, specific net outflow amounts of assets, transaction times (October 31 ET), estimated about $437,000, vault collateral nearly depleted

  3. Title: #PeckShieldAlert @PremiaLabs has been exploited for $464.6K. Publisher: PeckShieldAlert (@PeckShieldAlert) Date: 2026-11-01 URL: https://x.com/PeckShieldAlert/status/2116758393067340132 Nature of source: direct post by the party involved Verification status: the full original post and image clues were read for this report, verification date 2026-11-01 Supporting details: losses of about $464,600, funds bridged from Arbitrum to Ethereum, exchanged into BTC through Chainflip and NEAR Intents

ABAB AI Insight

Premia Labs has operated a decentralized options protocol since 2021, and has gone through v1 (a peer-to-peer order book), v2 (AMM), and v3/Blue launched in 2023 (concentrated-liquidity AMM + peer-to-peer quotes). Its vaults are designed for passive options strategies and collateral support, allowing liquidity providers to earn yields by selling options. This attack exploited the interaction mechanism between the options pool and the vault collateral, rather than a simple direct theft of funds, which is consistent with Blockaid’s described path of “collateral locked first and then withdrawn as liquidity.” DefiLlama data shows that Premia V3’s recent TVL was around the $500,000 range, so this loss is significant relative to its size.

The attack funds were first bridged to Ethereum, and then exchanged into BTC via Chainflip (a cross-chain swap protocol) and NEAR Intents (an intent-based aggregation transaction layer). Chainflip and NEAR Intents have been used in several recent incidents for fund movement and exchange; the former provides privacy-enhanced cross-chain capability, while the latter supports multi-chain intent execution. The $464,600 valuation given by PeckShield is higher than Blockaid’s $400,500 and The Defiant’s about $437,000; the difference may come from the valuation time, price source, or whether later-transferred assets were included. As of verification, Premia Labs had not released a public explanation regarding the vault status or user compensation.

Compared with other options protocol vault incidents in 2023–2024, this attack relied more on internal protocol pool routing rather than external oracle manipulation or a direct privilege breach. For example, some earlier DOV (DeFi Options Vault) protocols were exploited because of pricing or settlement logic, but the funds scale and transfer speed were different. Premia’s vault design emphasizes collateral locking and liquidity withdrawal; this attack used that path in reverse. After the attack, direct holdings in the vaults dropped sharply, but the valuation of unexpired options positions themselves was not affected.

This incident changed the availability of direct collateral in Premia Labs’ vaults, limiting the liquidity support for the related options strategies and users’ withdrawal ability. The attacker quickly converted the assets into BTC through standard cross-chain and intent tools, reducing the immediate window for freezing or tracking them afterward. For liquidity providers relying on Premia vaults, the short-term costs are collateral loss and a decline in protocol credibility; if the protocol does not promptly pause or upgrade the relevant pool logic, it may face further withdrawal risk. Indicators to watch include changes in the remaining collateral in the affected vaults, whether Premia issues an official update, and subsequent activity of the relevant addresses on the Ethereum and BTC networks.

ABAB News · Law of Cognition

  1. Once vault collateral is locked by an options pool, it can be withdrawn in reverse, and the mechanism flaw appears before the fund scale does.

  2. Bridging to Ethereum and then exchanging BTC through an intent layer is a common standardized path for DeFi attack funds at present.

  3. The valuation differences among different monitors for the same event come from timing and methodology, rather than a single definitive loss figure.