Premia Labs
- Funds lost
- $401K
- Attack type
- Other
- Network
- Arbitrum
- Category
- Yield Aggregator
Summary
On October 31, 2026, decentralized options protocol Premia V3 suffered a smart contract exploit on Arbitrum, resulting in the loss of approximately $400,500 to $464,600 across six underwriter vaults (WBTC, WETH, USDC.e, and ARB call and put vaults). The attacker manipulated option pool creation and liquidity routing to extract vault collateral using flash-loaned capital.
Details of the Exploit
The exploit targeted six Premia V3 underwriter vaults on Arbitrum by abusing the interaction between vault collateral locking and newly initialized option pools. The attacker initially executed a setup transaction to create six custom, empty option pools. Using flash loans (including assets borrowed from Balancer), the attacker bought options across these new pools, which forced the victim underwriter vaults to lock their underlying collateral (WBTC, WETH, USDC.e, and ARB) into those specific option pools.
Immediately following the collateral lock, the attacker exploited a liquidity withdrawal path within the pool mechanics to extract the collateral as liquidity, allowing them to pay back the flash loans while draining the vaults' direct balances down to near-zero. The stolen funds were subsequently bridged from Arbitrum to Ethereum and swapped into Bitcoin via cross-chain protocols Chainflip and NEAR Intents.
Source: De.Fi REKT Database. Data as of November 3, 2026.