Premia Exploit: Empty Option Pools Drained Six Vaults

Originally published at Premia Exploit: Empty Option Pools Drained Six Vaults

On 1 November 2026, an attacker emptied six Premia v3 underwriter vaults on Arbitrum in two transactions sent one second apart. The vaults lost 3.644 WBTC, 43.47 WETH, 48,479 USDC.e and 46,215 ARB, which The Defiant valued at about $437,000. Blockaid flagged the attack while it was still running and described the method in one sentence: the attacker created empty option pools, flash-loaned capital, bought options so that vault collateral was locked into those pools, and then withdrew that collateral as liquidity.

No key was stolen and no oracle was bent. The vaults did what their code allowed: they underwrote options in markets that the attacker had created a minute earlier. This post walks through what Premia's vaults do, what the chain shows, what is still unknown, and what builders and auditors of options and structured-product vaults should take from it.

TL;DR

• Protocol: Premia v3, an options protocol. Affected contracts: six "Short Volatility" underwriter vaults (WBTC, WETH and ARB calls and puts).
• Chain: Arbitrum One.
• Loss: 3.64410382 WBTC, about 43.47 WETH, 48,479.36 USDC.e and 46,215.43 ARB in net outflows, about $437K (The Defiant). Blockaid's mid-attack estimate was about $400.5K; PeckShield reported about $464.6K.
• Method (as reported by Blockaid): permissionlessly create empty option pools, borrow working capital from Balancer, buy options from the vaults so their collateral moves into those pools, then take the collateral out as liquidity.
• Root cause: not yet confirmed by Premia. The evidence points at the trust boundary between the vaults and pools that anyone can deploy.
• Funds: PeckShield reported the proceeds were bridged to Ethereum and swapped to BTC through Chainflip and NEAR Intents.

What Premia v3 Vaults Do

Premia v3 splits options trading into two layers. Pools are per-series markets: one pool per base/quote pair, strike, maturity and call/put flag, deployed through a factory. Anyone can create a new series. Underwriter vaults sit above the pools. Depositors put a single asset into a vault, and the vault uses it as collateral to sell (write) options to buyers, collecting premiums in return. A call vault holds the base asset (WBTC, WETH or ARB); a put vault holds USDC.e.

When a buyer trades with a vault, the vault writes options into the matching pool. Writing an option means locking collateral in that pool so the buyer can be paid if the option ends in the money. That collateral leaves the vault's balance sheet and sits in the pool until the series settles.

This design is common. It is also exactly where an attacker would look first: the vault holds real deposits, and it will move them into a pool contract on request, provided the trade passes the vault's checks. If those checks treat every factory-deployed pool as a legitimate market, the security of depositors' money depends on how a brand-new, empty pool behaves.

What Happened On-Chain

We read the blocks and receipts directly from a public Arbitrum node. The sequence is short.

1. Setup, 03:14:37 UTC, block 520,166,285. The attacker address 0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd called its contract 0x577168C8c6fA937495C3D6961f1d7D734b2d785f (transaction 0xe3c263fc...31f5). Reporting relayed by KuCoin News says this transaction created the six option-pool contracts used later.
2. First drain, 03:15:39 UTC, block 520,166,479 (0x64602cbb...41ac). The attack contract borrowed tokens from the Balancer Vault, including 0.9 WBTC, 11 WETH and 6,000 USDC.e. Option tokens with names such as WBTC-USDC-06NOV2026-78000-C and WETH-USDC-06NOV2026-2200-P were minted and burned, collateral moved from the vaults into the new pools and then on to the attack contract, and Balancer was repaid.
3. Second drain, 03:15:40 UTC, block 520,166,483 (0xd7e8086d...44ff). Same sender, same contract, same selector. This one borrowed 12,000 ARB and 9,500 USDC.e and repeated the pattern against the ARB vaults.

Both drain transactions succeeded, and each produced close to 400 log entries. Summing only the ERC-20 transfers into and out of the six vault addresses across both transactions gives these net outflows:

Vault	Asset	Net outflow
WBTC call	WBTC	3.644104
WETH call	WETH	43.472546
ARB call	ARB	46,215.428616
WBTC put	USDC.e	20,215.067131
WETH put	USDC.e	21,333.613826
ARB put	USDC.e	6,930.677768

The three put vaults together lost 48,479.36 USDC.e, which matches The Defiant's figure exactly. After the attack, the WBTC call vault held about 0.00087 WBTC and the put vaults between about 45 and 126 USDC.e. By TVL, that is most of what Premia v3 had on Arbitrum: DefiLlama showed roughly $533K just before the attack.

The flash loans were only working capital. They were repaid inside the same transactions. The profit came entirely from depositor collateral.

Coindaro also found ten smaller outflows from the same vaults over the next two hours, worth about $16K in total, from other addresses. Who sent them is not known; they may be copycats, the same actor or a rescue effort. They are not included in the figures above.

Root Cause: Vaults That Trust Any Pool

Premia has not published a post-mortem, so the precise vulnerable function is not confirmed. What is public is enough to describe the shape of the bug.

The key ingredients are:

• Permissionless markets. The attacker deployed the six fresh pools, all with a 6 November 2026 expiry.
• A vault willing to underwrite into them. The vaults accepted trades against those new series and locked their own collateral there.
• A pool that let that collateral leave. Once inside a pool that only the attacker had touched, the collateral came back out to the attacker's contract as if it were the attacker's own liquidity.

In other words, the vault's assumption was "a pool deployed by our factory is a safe place for our collateral". That only holds if every state a pool can be in, including empty, first-trade and single-participant states, keeps the vault's collateral attributed to the vault. An empty pool is the most extreme edge case there is: the attacker is the only other counterparty, sets the opening conditions, and can sequence every step inside one transaction.

The snippet below is a simplified, hypothetical illustration of that trust pattern. It is not Premia's code.

// SIMPLIFIED ILLUSTRATION - not Premia's actual implementation
function trade(PoolKey calldata key, uint256 size, uint256 maxPremium) external {
    // Any pool the factory can derive is treated as a valid market
    address pool = factory.getPoolAddress(key);
    require(pool != address(0), "no pool");
    require(_isValidListing(key), "bad strike or maturity");

    uint256 premium = _quote(key, size);
    require(premium <= maxPremium, "slippage");
    asset.safeTransferFrom(msg.sender, address(this), premium);

    // Vault collateral leaves the vault and is locked in the pool
    uint256 collateral = _collateralFor(key, size);
    asset.approve(pool, collateral);
    IPool(pool).writeFrom(address(this), msg.sender, size);

    // From here on, the vault relies entirely on the pool's accounting
    // to keep that collateral attributed to the vault.
}

Nothing in this sketch is obviously wrong in isolation. Strike and maturity are checked, the premium has a slippage bound, and the pool is a genuine factory deployment. The problem is the last comment. If pool-side accounting can be steered by whoever created the pool, especially when the pool has no other liquidity, a vault-level check that only asks "is this a real pool?" offers no protection.

Why Brand-New Markets Are Dangerous

The Premia case joins a long list of exploits where the first moments of a contract's life were the weak point. Empty ERC-4626 vaults are vulnerable to share inflation. Fresh lending markets have been drained through rounding on the first deposit. And a flash loan let an attacker dictate a thin pool's spot price for one transaction in the KolanHook exploit.

Empty markets are dangerous for three reasons:

• The attacker is the whole market. No other liquidity providers or traders constrain prices, balances or ordering.
• Edge-case arithmetic is live. Zero totals, first-position branches and division by small numbers are paths that normal tests rarely exercise with hostile inputs.
• Atomicity removes risk. With a flash loan, the attacker can create conditions, extract value and repay inside one transaction, so failure costs only gas.

There is also an operational angle. Premia's team now builds Kyan, its newer platform, but the v3 contracts were still live and still held deposits. As we saw last week with the Troves legacy rebalancer, code a team has stopped watching keeps running for as long as it holds funds.

Lessons for Builders and Auditors

1. Allowlist the markets a vault may underwrite. Composability is great for traders and dangerous for pooled collateral. A vault that holds depositors' assets should only write into pools that governance or a curator has approved, or at minimum into pools that meet liquidity, age and parameter requirements. "Deployed by our factory" is not a risk check.

2. Treat pool creation as an attacker capability. In threat models for permissionless factories, assume the attacker deploys the pool, chooses its parameters and is the only counterparty. Every function a vault calls on a pool should be reviewed under that assumption.

3. Verify collateral attribution end to end. After a vault writes into a pool, write invariant tests that check the vault's claim on that collateral cannot fall unless an option is exercised against it. Fuzz the sequences create pool, trade, add or remove liquidity, settle, all from one actor and inside one transaction.

4. Cap per-market and per-block exposure. Six vaults lost almost everything within one second. Limits on how much collateral can enter a single new series, or how much a vault can underwrite per block, would have bounded the damage even with the underlying bug present.

5. Sunset old deployments deliberately. When a protocol moves to a new version, either wind down the old vaults, pause new underwriting, or keep monitoring and bug-bounty coverage in place. Our smart contract security checklist covers the monitoring side of this.

6. Monitor for the pattern, not just the loss. A single address creating several pools and then trading against vaults in the next minute is an unusual sequence. Alerts on new-series creation followed by large vault trades can buy time for a pause.

What Is Still Unknown

• The exact vulnerable function. Blockaid's description fits either a vault-side or a pool-side flaw; no one has publicly pinned it to a specific line of code.
• The final loss figure. $400.5K (Blockaid, during the attack), about $437K (The Defiant, net collateral at prices around 04:16 UTC) and $464.6K (PeckShield) measure different things and should not be added together.
• Premia's response. At the time of writing we found no official statement, post-mortem, pause notice or bounty offer.
• The later outflows. The ten smaller withdrawals reported by Coindaro are not attributed.

Key Addresses and Transactions

Item	Value
Attacker address (tx sender)	0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd
Attack contract	0x577168C8c6fA937495C3D6961f1d7D734b2d785f
Setup tx (block 520,166,285)	0xe3c263fcae544954367998e48e13112875cfd38a3b9a240e7818bb96313831f5
Drain tx 1 (block 520,166,479)	0x64602cbbeba5d3c7a5e2cff4f98cc118886fc6051c56fa50458abec2c90441ac
Drain tx 2 (block 520,166,483)	0xd7e8086df0570c5389ca27eb9bcdff290e810c094155b410a42e5bad2b3244ff
WBTC call vault	0x45dF5EA836A15B561937Ae8373ab9eE984aea531
WETH call vault	0xbae43c546DFADC69576aE73C68e0694A54F08e1B
ARB call vault	0xDC631d88dbB5eb39f5c4Bf8B4e5298d098912fFf
WBTC put vault	0x6A1FC0E1c60BA6564CDe4910A425F1F1a1d18C1F
WETH put vault	0xD46993F25D298ebbCD31E941156C66f7e628A52a
ARB put vault	0xBe3E229319f86f5ee96ee1dc0b6d55e8b68a439e

Sources

• Blockaid on X: live exploit alert: method description and the ~$400.5K mid-attack estimate
• Arbiscan: first drain transaction and second drain transaction
• The Defiant via Cryptonews.net: attacker drains about $437,000 from Premia vaults: per-asset net outflows and post-attack balances
• Coindaro: six Arbitrum vaults lose about $437,000: block numbers, vault addresses, flash-loan amounts and later outflows
• 0xCERT-2026-0297 advisory: PeckShield's $464.6K figure and the Chainflip / NEAR Intents exit route
• TSN: Premia exploit drains six Arbitrum options vaults
• Arbitrum blocks and transaction receipts read from the public Arbitrum One RPC: timestamps, senders, status and ERC-20 transfer totals

Closing Thoughts

The Premia exploit did not need a price oracle, a stolen key or a novel cryptographic trick. It needed a vault that would put real collateral into a market nobody else had ever used. If your protocol lets anyone create markets and lets pooled capital flow into them, the empty-market case is your threat model, not an edge case. If you are building vaults, options or any permissionless market factory, talk to our team or see our audit pricing to have those trust boundaries reviewed before an attacker reviews them for you.