Premia Vaults on Arbitrum: Empty Option Pools Locked, Then Withdrew Collateral

~$400.5K drained "so far" while the attack was ongoing, per Blockaid; $464.6K, per PeckShield. No Premia statement found as of publication.

Root cause: Per Blockaid: the attacker "created empty option pools, flash-loaned, and bought options so vault collateral locked into those pools, then withdrew it as liquidity." Premia has not published a root cause.

Timeline, as sourced: Blockaid alert 1 Nov 04:13 UTC (attack ongoing); PeckShield 05:05 UTC.

Per Blockaid (alert (opens in a new tab)): an ongoing exploit on Premia on Arbitrum drained ~$400.5K from vaults across ~2 transactions at the time of posting. Blockaid lists exploiter addresses 0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd (opens in a new tab) and 0x577168C8c6fA937495C3D6961f1d7D734b2d785f (opens in a new tab), an example tx (opens in a new tab) and victim vaults 0x45dF5EA836A15B561937Ae8373ab9eE984aea531 (opens in a new tab), 0xbae43c546DFADC69576aE73C68e0694A54F08e1B (opens in a new tab) and 0xD46993F25D298ebbCD31E941156C66f7e628A52a (opens in a new tab) (thread (opens in a new tab)).

Per PeckShield (alert (opens in a new tab)): Premia was exploited for $464.6K; the exploiter bridged funds from Arbitrum to Ethereum, then swapped them to BTC via Chainflip and NEAR Intents.

Unknown: Premia's own account, the contract check that failed, and any recovery.