SECURITY ALERT
The pools were empty.
The collateral filled them anyway.
An attacker pulled about $400,500 of collateral out of vaults run by options protocol Premia on Arbitrum early on Sunday, security firm Blockaid said on X at 04:13 UTC, calling the exploit “ongoing”.
The method, as Blockaid describes it: create empty option pools, take a flash loan, which is a loan borrowed and repaid inside one transaction, and buy options so the vaults’ collateral gets locked into those pools.
Then withdraw it as liquidity.
Blockaid counted about two transactions. The Defiant put the total at about $437,000 across six vaults.
Blockaid named two exploiter addresses:
0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd
0x577168C8c6fA937495C3D6961f1d7D734b2d785f
Our read of Arbitrum shows the example transaction Blockaid flagged succeeded at 03:15:39 UTC, sent from the first address to the second, a contract.
Premia had made no public statement on X as of 04:50 UTC.
And on Starknet
Troves, a bitcoin yield platform, said on Saturday that its xWBTC/WBTC vault lost a preliminary 8.6 BTC through an old rebalancing contract that “retained permissions after being replaced”.
It says it revoked that contract within about 40 minutes and paused three vaults. A postmortem is promised.
Two vaults, two chains, one weekend, after b14g lost its staked CORE.
Protect yourself
- Premia vault depositors: do not deposit more until Premia says the vaults are safe.
- Revoke token approvals you no longer need on Arbitrum.
- Troves users: wait for the postmortem before moving funds through any unofficial link.
How many old permissions are still switched on?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.