Attacker Drains About $437,000 in Collateral From Premia Vaults

Premia runs automated options vaults on Arbitrum, pooling user collateral so the protocol can sell covered calls and puts for yield, a design similar to Ribbon Finance's Theta Vaults. That model only works if collateral stays locked until options expire and settle. The attacker found a path around that: moving vault collateral into the option pools themselves, then withdrawing it as ordinary liquidity, pulling out roughly $437,000 by Blockaid's count.

Depositors in the affected vaults are short that collateral, and Premia Labs now carries a reported $464,600 loss on Arbitrum. The protocol will need to patch the pool-withdrawal logic that let collateral be re-labeled as liquidity, and likely pause or re-audit similar vault strategies before new deposits resume. Traders who relied on these vaults for yield lose confidence in the mechanism, and the attacker walks away with funds already converted toward BTC.

The laundering trail matters as much as the exploit. Routing stolen funds through Ethereum, then Chainflip and NEAR Intents before cashing into BTC shows attackers now favor intent-based cross-chain swap services over mixers like Tornado Cash, sanctioned in 2022. These protocols pitch themselves as seamless, permissionless swap rails for ordinary users, but the same design that hides transaction intent from front-runners also hides it from investigators, a trade-off their operators have yet to resolve publicly.

Whether any of the $437,000 to $464,600 is recoverable now depends on Chainflip or NEAR Intents acting to flag or freeze the BTC-destination funds, something neither has confirmed. Premia's next move, a public post-mortem detailing the vault flaw and any compensation plan, will show whether depositors are made whole. Absent a freeze or a negotiated return, this becomes another unresolved exploit sitting on the ledger rather than a closed case.