Premia Labs hit by Arbitrum exploit; attacker converts stolen funds into Bitcoin Premia Labs has suffered an exploit on Arbitrum that resulted in roughly $464,600 in stolen crypto, according to blockchain security firm PeckShield. The attacker reportedly moved funds from Arbitrum to Ethereum and then routed them through cross-chain swapping services — including Chainflip and NEAR Intents — before converting the proceeds into Bitcoin. What happened - The incident targeted options vaults tied to Premia Labs, the on‑chain developer behind the Kyan derivatives platform. Security researchers say the attacker created new, empty options pools and used flash loans to manipulate those pools so vault collateral became locked into them. - By buying options that forced collateral into the attacker‑created pools, the exploiter was then able to withdraw that collateral as liquidity into attacker‑controlled wallets. - Blockaid first flagged the exploit on November 1, reporting roughly $400,500 drained across two transactions. PeckShield’s subsequent alert put the overall loss at about $464,600 — roughly 131 ETH at the valuation cited in early reports. The differing figures reflect separate assessments of the same incident and are not additive. Key technical details - Flash loans: large, unsecured loans that must be repaid within the same blockchain transaction. In this exploit, borrowed funds were used to execute trades that redirected vault collateral into the newly created pools. - The two principal withdrawals occurred around 03:15 UTC on November 1, about one second apart, per transaction records. - Assets taken included 3.64 wrapped BTC (wBTC), ~43.47 wrapped ETH (wETH), 48,479 USDC.e, and 46,215 ARB. Post‑heist movement PeckShield tracked the stolen assets as they moved from Arbitrum to Ethereum and then through Chainflip and NEAR Intents — two services that enable cross‑chain swaps — with Bitcoin reported as the end asset received. The use of multiple cross‑chain services complicates tracing because investigators must follow flows across networks. Security firms stressed that routing via those services does not imply they knowingly assisted the attacker, nor have they been identified as the source of the Premia vulnerability. Wider context The Premia exploit comes amid heightened scrutiny of crypto laundering and asset movement after the October 29 Binance hack, where stolen funds were similarly routed through multiple networks and DeFi protocols. That earlier incident prompted rapid responses from token issuers, protocol guardians, and law enforcement; for example, Aave temporarily restricted certain markets after attacker‑controlled wallets deposited and borrowed large sums. The FBI has urged platforms to block transactions tied to the Binance attacker. Status and response At the time of initial security reports, Premia Labs had not published a detailed public explanation of which vaults were affected, the root cause, or any recovery or reimbursement plans. Security teams continue tracking the funds and assessing the exploit’s mechanics. What to watch - Any follow‑up disclosures from Premia Labs detailing the vulnerability and remediation. - Further blockchain tracing that might reveal where the converted BTC went or whether any funds are recoverable. - Responses from Chainflip, NEAR Intents and other intermediaries regarding whether they observed or blocked suspicious swaps tied to the incident. We’ll update as new details emerge. Read more AI-generated news on: https://app.chaingpt.org/news