Decentralized options platform Premia Labs lost approximately $464,600, or about 131 ETH, on the Arbitrum network. The security exploit targeting the developer behind derivative protocol Kyan struck its options vault before the attacker moved the funds to another network.
The assets taken from the vault spanned four different tokens: 3.64 Wrapped Bitcoin (WBTC), around 43.47 Wrapped Ethereum (WETH), 48,479 USDC.e, and 46,215 Arbitrum (ARB) tokens. The estimated loss fluctuated during the incident; security firm Blockaid initially estimated losses at $400,500 while the exploit was underway, before PeckShield verified the total loss at $464,600.
The $464,600 exploit was carried out through a pool manipulation scheme leveraging a flash loan.
How an Empty Pool Was Used to Lock Collateral
Blockaid identified the attack vector as stemming from options pool manipulation. The hacker initiated the exploit by creating an empty options pool on Premia Labs. Using a flash loan, the attacker then bought option contracts that forced collateral from the protocol’s vault to be locked into the newly created pool.
Once the collateral was locked in the custom pool, the hacker withdrew it as liquidity directly into an attacker-controlled wallet. Two major collateral withdrawals were recorded on November 1, 2026, at around 03:15 UTC, occurring just one second apart.
Escape Route to Bitcoin Without KYC
After draining the assets on Arbitrum, the perpetrator transferred the stolen funds to the Ethereum network. Security firm PeckShield detected that the hacker used swap protocols Chainflip and NEAR Intents to convert all stolen assets into Bitcoin.
Using Chainflip and NEAR Intents provided tactical advantages for the attacker. These cross-chain swap services enabled the hacker to swap stolen assets into BTC without going through centralized exchanges requiring Know Your Customer (KYC) identity verification. This cross-chain swap path broke direct tracing and complicated tracking the funds across blockchains.
For the decentralized derivatives ecosystem, the Premia Labs incident highlights vulnerabilities in the interaction between new pool creation and vault collateral mechanisms. With the stolen funds converted to Bitcoin via non-KYC protocols, asset recovery now hinges on ongoing on-chain tracking.
Source: crypto.news.
Also read: What Is DeFi (Decentralized Finance)?
Also read: Binance Hacker Dumps 908,793 PROM Worth $5M - Receives Just $71 on Uniswap
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
