Blockaid reports an ongoing Premia vault exploit on Arbitrum
Blockaid reports an active Premia exploit on Arbitrum, with about $400,500 drained across roughly two transactions at the time of its alert. It describes empty option pools, flash loans and option purchases that lock vault collateral before its withdrawal as liquidity. No final loss total or verified fix is established.
- Disclosed
- Nov 1, 2026
- Updated Nov 1, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Premia v3 on Arbitrum; a later researcher report identifies six WBTC, WETH and ARB call/put vaults
- crypto
- In the wild
- Yes
- Blockaid reports actual vault drains and describes the exploit as ongoing at its alert.
What happened
Blockaid attributes the withdrawals to an exploit of the vault and options flow, rather than reporting an unexplained transfer alone. The alert’s snapshot supports L4 for active exploitation. It does not establish a final root cause, total affected deposits, attacker identity, completed containment or compensation. The precautions above are general exposure-reduction guidance; no vendor-approved exit procedure was verified.
November 1 address update: Blockaid’s next post links two exploiter addresses, one example transaction and three victim vaults. All six linked indicators are reproduced above. These vaults are examples, not a verified complete scope or a list of safe contracts. The explorer address pages returned access errors after normal redirects; the labels come from Blockaid, not an independent on-chain assessment. The earlier approximate $400,500 snapshot is retained; differing media valuations are not a reconciled final total.
November 1 research update: PandaSecurity reports six affected call/put vaults, with setup at 03:14:37 UTC followed by successful drains at 03:15:39 and 03:15:40 UTC. Its receipt analysis counts net outflows of 3.644104 WBTC, 43.472546 WETH, 46,215.428616 ARB and 48,479.36 USDC.e. These are researcher observations, not a vendor reconciliation. The report relays differing valuations of about $437,000 and $464,600; those are not amounts to add to Blockaid’s earlier estimate. Exact root cause, final scope and remediation remain unconfirmed.
Crime-scene timeline
Nov 1, 2026
Blockaid reports an ongoing Arbitrum vault exploit
Approximately $400,500 across about two transactions is a preliminary researcher estimate, not a reconciled final loss.
Nov 1, 2026
Blockaid publishes exploiter addresses and three victim-vault links
The follow-up adds a sample transaction, not a final loss figure or a verified fix.
Nov 1, 2026
Researchers report six vaults and two successful drain transactions
PandaSecurity reports directly reading Arbitrum receipts; this expands the earlier three-vault sample without establishing a vendor-confirmed final scope or fix.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Blockaid original Premia alertPrimaryPublic embed contains the Arbitrum exploit description, approximate amount and transaction count; later content is truncated.
- Official public embed of Blockaid's alertPrimary
- Blockaid original address follow-up, public embedPrimaryComplete post labels two exploiter addresses, an example transaction and three victim vaults; ordinary link redirects expose the Arbiscan targets.
- PandaSecurity original Premia researchPrimaryReports public-node receipt observations for two drains and six vaults; distinguishes those observations from relayed valuations and unconfirmed root-cause analysis.