Premia Labs, the developer behind the decentralized options and derivatives protocol, lost approximately $464,600 in an exploit on the Arbitrum network. Security firm Blockaid first flagged the incident as it unfolded, reporting that roughly $400,500 had left the protocol’s vaults across two transactions while the attack remained active.

PeckShieldAlert later put the total loss at $464,600, equivalent to about 131 ETH at the time of the breach. The funds belonged to depositors whose collateral backed option contracts in the affected vaults.

How the Attack Unfolded

According to Blockaid’s analysis, the attacker exploited the interaction between Premia’s vaults and option pools. The sequence began with the creation of empty option pools. A flash loan was then taken. Options were purchased, which locked vault collateral inside those newly created pools. Finally, the locked liquidity was withdrawn, draining the vaults.

The method relied on the protocol’s design for handling collateral and option positions rather than a simple smart-contract vulnerability. No official statement from Premia Labs confirming a pause, patch, or recovery plan had been issued at the time the alerts circulated.

Fund Movement and Conversion

After the drain, the stolen assets were bridged from Arbitrum to Ethereum. From there, the attacker routed the funds through Chainflip and NEAR Intents, converting them into Bitcoin. Both services facilitate cross-chain swaps and can reduce the visibility of transaction trails compared with standard bridges.

Security monitors tracked the path as Arbitrum to Ethereum, followed by the two conversion platforms, with Bitcoin as the final reported asset. The precise on-chain addresses involved in the initial drain were not publicly labeled as confirmed attacker wallets by the firms that first reported the event.

Token Context and Market Snapshot

Premia’s native token traded near $0.00459 with a market capitalization of about $360,000 and negligible 24-hour volume according to market data at the time. The reported loss figure exceeded the token’s market cap, though trading activity remained limited and did not show a clear reaction tied to the exploit in the immediate data.

Premia operates as a decentralized options protocol whose vaults hold collateral that supports option contracts. The drained vaults contained depositor funds used for that purpose. Depositors in the affected pools absorbed the direct loss, and no compensation framework had been announced in the available reports.

Independent security firms provided the primary public details. Blockaid issued the initial alert while the attack was described as ongoing, and PeckShieldAlert later published the higher loss estimate along with the cross-chain and conversion route. Official project channels had not released a post-mortem or confirmed recovery steps when the reports appeared.