Two transactions drain six Premia options vaults on Arbitrum

Six Premia options vaults on Arbitrum lost most of their directly held collateral through two transactions executed one second apart early November 1, according to public transaction records and independent analyses of the token-transfer logs.

The transactions matter because they show how permissionless market creation can become a security boundary for automated DeFi vaults. Analysts at Blockaid, PandaSecurity and Coindaro concluded that newly created option pools were used to draw collateral out of Premia’s underwriter vaults. Premia had not published a post-mortem or confirmed that explanation when checked for Coinburn’s November 2 midday edition.

What the chain establishes

Arbiscan records the first transaction as successful at 03:15:39 UTC on November 1 in block 520,166,479. The second succeeded at 03:15:40 UTC in block 520,166,483. Both came from the same address and called the same contract, which Arbiscan labels as a Premia exploiter and exploit contract. Explorer labels are third-party annotations, however; the transaction logs, rather than those labels, establish the asset movements.

PandaSecurity calculated net outflows from the six vault addresses of 3.64410382 wrapped bitcoin, approximately 43.47 wrapped ether, 48,479.36 bridged USDC and 46,215.43 ARB. Coindaro independently reported the same token quantities after summing the two transactions’ transfer logs.

Coindaro valued those assets at approximately $437,000 using DefiLlama prices around 04:12 UTC on November 1. That dollar figure is a point-in-time estimate, not a realized sale value. It can change with token prices and excludes later movements whose relationship to the original transactions is uncertain.

Other published loss estimates should not be added to that amount. Blockaid’s alert gave an approximately $400,500 estimate while describing the activity as ongoing, while a later PeckShield estimate reported by other outlets was approximately $464,600. The range reflects different timing and valuation methods, not evidence of three separate losses.

How analysts describe the mechanism

The transaction records show Balancer vault assets entering the called contract, option tokens being minted and burned, collateral leaving Premia-labelled vault addresses, and the borrowed assets returning to Balancer within the same transactions.

Blockaid’s analysis, relayed by TechFlow, says the actor created empty option pools, obtained temporary working capital through flash loans and bought options that caused Premia vault collateral to move into those pools. The collateral was then withdrawn as liquidity. PandaSecurity’s independent reconstruction reached the same broad conclusion after reading Arbitrum blocks and receipts.

The affected series carried November 6 expiry dates in their token names. Premia’s architecture separates option pools for individual markets from underwriter vaults that supply collateral. If a vault treated every factory-created pool as safe without sufficiently testing its initial state, a newly created pool could expose the collateral-routing logic analysts identified.

That remains an evidence-based reconstruction, not an operator-confirmed root cause. No reviewed source established whether the flaw resides in a vault contract, a pool contract or their interaction. The records also do not identify the person controlling the addresses.

Important limits remain

The observed transactions concern six Premia vaults on Arbitrum. They do not establish a vulnerability in Arbitrum itself, losses across every Premia product or a broader compromise of WBTC, WETH, USDC.e or ARB.

No verified figure for affected depositors, open options, recoverable assets or reimbursement was available. Premia also had not confirmed whether the vaults were paused or whether additional contracts shared the suspected weakness. Those questions require a first-party incident report or attributable remediation record.

Coinburn is therefore treating the token outflows and timing as verified onchain facts, the approximately $437,000 value as a time-bounded estimate, and the empty-pool explanation as a consistent but still unconfirmed security analysis.