An attacker drained about $437,000 in net collateral from six Premia options vaults on Arbitrum across two transactions, according to The Defiant’s analysis of onchain transfers displayed by Arbiscan.
The first transaction and second transaction executed a second apart at 11:15:39 p.m. and 11:15:40 p.m. ET on Oct. 31. Together, the vaults recorded net outflows of 3.64410382 wrapped bitcoin (WBTC), about 43.47 wrapped ether (WETH), 48,479.36 bridged USDC (USDC.e) and 46,215.43 ARB. The dollar estimate sums those net outflows at Arbiscan’s displayed prices around 12:16 a.m. ET on Nov. 1, rather than historical execution prices.
That left depositors with little collateral held directly in the affected vaults. The WBTC call vault held 0.0008738 WBTC, while the WETH call vault held about 0.0373 WETH in the post-attack snapshots. Those balances do not include a valuation of outstanding option positions.
Security firm Blockaid warned, “Attack still ongoing,” in an alert posted at 12:13 a.m. ET on Nov. 1. That statement describes the firm’s assessment at the time of its alert, not confirmation of the attack’s status at publication.
https://x.com/i/status/2116745378674463229
How Collateral Left the Vaults
Premia’s underwriter-vault documentation describes vaults that pool depositors’ collateral to back call and put options. Buyers pay premiums, and depositors receive shares representing their participation in the vault.
According to Blockaid, the attacker created empty option pools, took flash loans and bought options so that vault collateral became locked in those pools. The attacker then withdrew that collateral as liquidity. In effect, funds committed to backing options became funds the attacker could remove.
The onchain transfers corroborate the collateral’s route. In the first transaction, Balancer’s vault sent WBTC, WETH and USDC.e to the attack contract. Premia vaults then transferred collateral into option pools, which sent tokens to the attack contract; the contract repaid Balancer. A preceding setup transaction created the six option-pool contracts used in the two draining transactions.
The other affected vaults also retained small directly held balances: the ARB call vault held about 160.89 ARB. The WETH, WBTC and ARB put vaults held approximately 125.73, 88.54 and 45.22 USDC.e, respectively.