Premia Options-Vault Empty-Pool Exploit

On November 1, 2026, Premia — a decentralized options protocol on Arbitrum — had six of its options vaults drained for approximately $0.46 million after an attacker abused the way those vaults routed collateral into newly created, empty option pools. No price oracle was manipulated and no key was stolen; the loss came from a smart-contract trust-boundary flaw, with flash loans serving only as working capital.

What happened

Premia lets anyone deploy an option pool through its factory, and the vaults appear to have treated any factory-deployed pool as a legitimate market. In two transactions mined about one second apart near 03:15 UTC, the attacker created six empty option pools (all expiring November 6, 2026), took flash loans from Balancer for working capital, and bought options so that vault collateral was moved into those attacker-controlled pools. The collateral could then be withdrawn to the attacker's contract as if it were the attacker's own liquidity, with the flash loans repaid inside the same transactions. Loss estimates varied by who counted: PeckShield put it at about $464,600 (roughly 131 ETH), independent on-chain analysis cited by The Defiant put net collateral losses near $437,000, and Blockaid's early count during the live attack was about $400,500 — the differences reflect separate assessments rather than additional thefts. The drained assets comprised roughly 3.64 WBTC, 43.47 WETH, 48,479 USDC.e and 46,215 ARB across the WBTC, WETH and ARB call and put vaults.

Aftermath

The attacker bridged the stolen assets from Arbitrum to Ethereum and then swapped them into Bitcoin through Chainflip and NEAR Intents, according to PeckShield; the reported transfers did not indicate that either service knowingly assisted. The on-chain footprint was public: analysts attributed the drains to attacker address 0xbeBa…4dBd operating through attack contract 0x5771…785f, with the two drain transactions mined one second apart. As of initial reporting, Premia Labs had not published a detailed post-mortem, named a confirmed root cause, or announced any reimbursement plan for affected depositors.

Why it matters

Premia's loss is a reminder that permissionless composability is itself an attack surface: a vault that trusts any factory-deployed pool as a valid venue can be tricked into shipping its collateral into an attacker's empty market. The exploit needed no oracle and no stolen key — only a logic gap and a flash loan for working capital, the same cheap-capital pattern seen in Balancer V2 and Abracadabra. It also underlines how quickly stolen DeFi funds now cross chains and asset types: within the same session the proceeds were bridged to Ethereum and converted to Bitcoin via cross-chain swap services, shrinking the window for issuer freezes or clawbacks.