An attacker drained approximately $437,000 in collateral from six Premia vaults on Arbitrum in two transactions executed one second apart late on Oct. 31, according to onchain data and an alert issued by blockchain security firm Blockaid.

The two transactions were executed at 11:15:39 p.m. and 11:15:40 p.m. Eastern Time on Oct. 31. The loss estimate was calculated from net token outflows using prices displayed by Arbiscan around 12:16 a.m. ET on Nov. 1, rather than the historical execution prices of the transactions.

Vaults Lose Bitcoin, Ether, USDC and ARB Collateral

The combined net outflows across the six affected vaults totaled 3.64410382 WBTC, approximately 43.47 WETH, 48,479.36 bridged USDC (USDC.e) and 46,215.43 ARB. Based on the prices used in the analysis, the estimated dollar value of these assets reached approximately $437,000.

Post-incident snapshots showed that some vaults retained almost no collateral in their direct balances. The WBTC call vault held just 0.0008738 WBTC, while the WETH call vault had approximately 0.0373 WETH remaining.

Other affected vaults also showed limited directly held assets. The ARB call vault retained approximately 160.89 ARB, while the WETH, WBTC and ARB put vaults held approximately 125.73, 88.54 and 45.22 USDC.e, respectively.

These figures reflect the assets held directly in the vaults after the transactions. They do not account for the valuation of outstanding option positions, meaning the remaining token balances alone do not establish the full financial position of each vault.

Blockaid Warns Attack Was Still Ongoing

Blockaid issued an alert at 12:13 a.m. ET on Nov. 1 stating, "Attack still ongoing." The warning reflected the firm's assessment at the time the alert was published and does not independently confirm whether the incident continued afterward.

The reported transfers were analyzed using onchain activity displayed by Arbiscan. Transaction records showed collateral moving between Balancer's vault, Premia vaults, option pools and the attack contract, with funds returned to Balancer as part of the transaction sequence.

How the Premia Vault Exploit Worked

Premia's underwriter-vault documentation describes a system in which depositors pool collateral to support call and put options. Option buyers pay premiums, while depositors receive shares representing their participation in the vault.

According to Blockaid, the attacker created empty option pools, obtained flash loans and purchased options that caused vault collateral to become locked in those pools. The attacker then withdrew the collateral as liquidity, allowing assets intended to back options to be removed from the affected vaults.

The onchain transaction sequence provided further detail on how the funds moved. In the first draining transaction, Balancer's vault transferred WBTC, WETH and USDC.e to the attack contract. Premia vaults subsequently moved collateral into option pools, which then sent tokens to the attack contract before the contract repaid Balancer.

A separate setup transaction conducted before the two draining transactions created the six option-pool contracts involved in the operation. The sequence links the pool creation, the collateral movements and the subsequent transfers to the attack contract.

Scope of the Loss Estimate

The estimated $437,000 figure represents net collateral outflows calculated using the Arbiscan price snapshot described above. The available information does not establish the historical execution value of every transferred asset, nor does it provide a final accounting of any additional losses.

Source: The Defiant