{"id":24944,"date":"2026-11-01T21:05:21","date_gmt":"2026-11-01T21:05:21","guid":{"rendered":"https:\/\/cryptoted.net\/index.php\/2026\/11\/01\/premia-labs-loses-464k-in-arbitrum-exploit-as-hacker-swaps-funds-for-btc\/"},"modified":"2026-11-01T21:05:21","modified_gmt":"2026-11-01T21:05:21","slug":"premia-labs-loses-464k-in-arbitrum-exploit-as-hacker-swaps-funds-for-btc","status":"publish","type":"post","link":"https:\/\/cryptoted.net\/index.php\/2026\/11\/01\/premia-labs-loses-464k-in-arbitrum-exploit-as-hacker-swaps-funds-for-btc\/","title":{"rendered":"Premia Labs loses $464K in Arbitrum exploit as hacker swaps funds for BTC"},"content":{"rendered":"<p> <br \/>\n<br \/><img decoding=\"async\" src=\"https:\/\/media.crypto.news\/2025\/06\/crypto-news-Hackers-keep-exploiting-audited-DeFi-protocols-option01.webp\" \/><\/p>\n<div>\n<p class=\"is-style-lead\">Premia Labs has suffered an estimated $464,600 cryptocurrency exploit on Arbitrum, with the attacker reportedly moving stolen funds across blockchains before converting them into Bitcoin.<\/p>\n<div id=\"cn-block-summary-block_4e7fb624ffee898615bdd4b7c7ef6466\" class=\"cn-block-summary\">\n<p>\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/p>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>PeckShield reported that Premia Labs lost approximately $464,600 in an exploit targeting its options vaults on Arbitrum.<\/li>\n<li>Blockaid traced the attack to empty options pools, flash loans and transactions that allowed the attacker to withdraw vault collateral.<\/li>\n<li>The stolen assets reportedly moved from Arbitrum to Ethereum before being converted into Bitcoin through Chainflip and NEAR Intents.<\/li>\n<li>Independent on-chain analysis identified six affected vaults containing WBTC, WETH, USDC.e and ARB.<\/li>\n<li>The attack follows several cryptocurrency security incidents involving cross-chain transfers and decentralized trading services.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>According to blockchain security firm PeckShield, the attacker transferred the stolen assets from Arbitrum to Ethereum before using Chainflip and NEAR Intents to swap them into BTC. Its November 1 <a href=\"https:\/\/x.com\/PeckShieldAlert\/status\/2116758393067340132\" target=\"_blank\">security alert<\/a> placed the losses at $464,600, equivalent to roughly 131 ETH at the valuation cited in the initial reports.<\/p>\n<p>The incident affected options vaults associated with Premia Labs, the on-chain development company behind the Kyan derivatives platform. Security researchers identified a series of transactions that moved collateral out of the vaults using newly created trading pools.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\"><strong>Premia Labs attacker drains options vaults using flash loans<\/strong><\/h2>\n<p>Blockchain security firm Blockaid first <a href=\"https:\/\/x.com\/blockaid_\/status\/2116745378674463229\" target=\"_blank\">flagged the exploit<\/a> on November 1, reporting that approximately $400,500 had been drained across two transactions.<\/p>\n<p>Its initial findings described an attacker who created empty options pools, borrowed funds through flash loans and purchased options that caused vault collateral to become locked inside those pools.<\/p>\n<p>The attacker then withdrew the collateral as liquidity, allowing assets originally held in Premia\u2019s vaults to move into attacker-controlled wallets.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8Blockaid detected an ongoing exploit on <a href=\"https:\/\/x.com\/PremiaLabs?ref_src=twsrc%5Etfw\">@PremiaLabs<\/a> on Arbitrum.<br \/>Created empty option pools, flash-loaned, and bought options so vault collateral locked into those pools, then withdrew it as liquidity.<br \/>~$400.5k drained from the vaults so far across ~2 txs. Attack still ongoing.\u2026<\/p>\n<p>\u2014 Blockaid (@blockaid_) <a href=\"https:\/\/x.com\/blockaid_\/status\/2116745378674463229?ref_src=twsrc%5Etfw\">November 1, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Flash loans allow users to borrow cryptocurrency without providing traditional collateral, provided the loan is repaid within the same blockchain transaction.<\/p>\n<p>In this case, Blockaid\u2019s findings indicate that the borrowed funds helped the attacker execute trades that redirected vault assets into pools created for the operation.<\/p>\n<p>The security firm warned that the exploit was ongoing when it published its first findings. Its $400,500 estimate therefore covered the transactions identified at that stage, while PeckShield subsequently reported the larger $464,600 figure.<\/p>\n<p>The affected assets included 3.64 wrapped Bitcoin, approximately 43.47 wrapped Ethereum, 48,479 USDC.e and 46,215 ARB.<\/p>\n<p>According to the transaction records, the two principal withdrawals occurred around 03:15 UTC on November 1, approximately one second apart.<\/p>\n<p>The different loss estimates reflect separate assessments of the incident and should not be treated as additional thefts.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Stolen Premia funds move through Chainflip and NEAR Intents<\/strong><\/h2>\n<p>Once the collateral had left the affected vaults, PeckShield tracked the stolen assets moving from Arbitrum to Ethereum.<\/p>\n<p>The attacker reportedly continued the transfers through Chainflip and NEAR Intents, two services that support cryptocurrency swaps across different blockchain networks.<\/p>\n<p>Chainflip allows users to exchange assets between supported networks without relying on a conventional centralized exchange. NEAR Intents coordinates transactions in which users specify the assets they want to receive.<\/p>\n<p>PeckShield identified Bitcoin as the asset received through the reported conversion route.<\/p>\n<p>The use of multiple services means investigators must follow transactions across separate blockchain networks to establish where stolen assets were sent.<\/p>\n<p>However, the reported transfers do not establish that either platform knowingly assisted the attacker. Neither service has been identified as the source of the Premia vulnerability.<\/p>\n<p>The Premia incident comes amid increased attention on cryptocurrency laundering following the October 29 Binance hack.<\/p>\n<p>As crypto.news <a href=\"https:\/\/crypto.news\/binance-hack-what-happened-and-where-the-6-3-billion-went\/\" target=\"_blank\">previously reported<\/a>, the Binance attacker moved stolen assets through multiple networks, while token issuers and blockchain investigators worked to freeze funds.<\/p>\n<p>Investigators traced some of those assets into decentralized lending and swapping services, where transactions continued after the initial theft.<\/p>\n<p>The Premia attacker used a different method to obtain funds, with Blockaid identifying options-pool manipulation instead of compromised exchange wallet controls.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Crypto investigators face another cross-chain security incident<\/strong><\/h2>\n<p>The movement of stolen funds through DeFi services has drawn scrutiny following several recent cryptocurrency attacks.<\/p>\n<p>During the Binance incident, investigators identified an attacker-controlled wallet that deposited 60 million USDT into Aave before borrowing approximately 19,762 wrapped ETH.<\/p>\n<p>The borrowing activity prompted Aave\u2019s security guardians to introduce temporary restrictions across several lending markets.<\/p>\n<p>An October 31 <a href=\"https:\/\/crypto.news\/aave-wasnt-hacked-why-did-its-users-face-restrictions\/\" target=\"_blank\">investigation into Aave<\/a> found that the lending protocol itself had not been compromised, although its emergency measures temporarily restricted new deposits and borrowing.<\/p>\n<p>Aave subsequently reopened its affected markets after completing security checks.<\/p>\n<p>Separately, the <a href=\"https:\/\/crypto.news\/binance-hack-eip-7702-wallet-attack\/\" target=\"_blank\">Binance wallet investigation<\/a> identified malicious Ethereum authorization transactions that allowed the attacker to redirect funds from a hot wallet.<\/p>\n<p>Those incidents involved different weaknesses, but investigators encountered stolen assets moving between cryptocurrency networks and financial protocols.<\/p>\n<p>The FBI has since urged exchanges, decentralized finance operators and blockchain service providers to block transactions linked to identified attackers from the Binance breach.<\/p>\n<p>Premia Labs had not released a detailed public explanation of the affected vaults, recovery arrangements or any planned reimbursement at the time of the initial security reports.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><br \/>\n<br \/><a href=\"https:\/\/crypto.news\/premia-labs-464k-arbitrum-exploit-chainflip-near-intents\/\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Premia Labs has suffered an estimated $464,600 cryptocurrency exploit on Arbitrum, with the attacker reportedly moving stolen funds across blockchains before converting them into Bitcoin. Summary PeckShield reported that Premia Labs lost approximately $464,600 in an exploit targeting its options vaults on Arbitrum. Blockaid traced the attack to empty options pools, flash loans and transactions [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":24945,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[23],"tags":[],"kronos_expire_date":[],"class_list":["post-24944","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"_links":{"self":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/24944","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/comments?post=24944"}],"version-history":[{"count":0,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/posts\/24944\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media\/24945"}],"wp:attachment":[{"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/media?parent=24944"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/categories?post=24944"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/tags?post=24944"},{"taxonomy":"kronos_expire_date","embeddable":true,"href":"https:\/\/cryptoted.net\/index.php\/wp-json\/wp\/v2\/kronos_expire_date?post=24944"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}