Web3 Daily Exploits — 1 Nov 2026: Premia $465K Arbitrum Options Drain, Troves 8.6 BTC Legacy Perm, b14g 97M CORE Zero-Withdraw

The 1 Nov America/Panama window records three first-reported or materially updated protocol incidents used for scoring. PremiaLabs options vaults on Arbitrum lost approximately $464.6K (PeckShield figure; other estimates $400K–$437K) when an attacker created empty option pools, used flash loans to buy options, locked vault collateral, and withdrew it as liquidity. Troves reported a preliminary loss of approximately 8.57–8.6 WBTC-equivalent from its xWBTC/WBTC vault on Starknet after a legacy rebalancing contract retained permissions post-replacement. Separately, b14g’s dual-staking protocol on Core saw approximately 97.05 million CORE (valued around $1.47M at the time) extracted in one transaction when zero-amount withdrawal requests were interpreted by the underlying staking code as full-balance withdrawals. Combined live loss on this card is ~$2.6M. The prior Binance hot-wallet signing-access compromise (~$6.3B) remains an UPDATE; ongoing on-chain movement and partial withdrawal resumption are recorded but not re-scored. Recheck of monitored accounts confirmed these as the primary scored items with fresh or materially updated loss figures in the last 24 hours.

PremiaLabs — Arbitrum — ~$465K — empty option pools / flash-loan liquidity extraction

What happened: Early on 1 November 2026 UTC (late 31 October ET), an attacker targeted six Premia options vaults on Arbitrum. The method, as described by Blockaid and subsequent analyses, involved creating empty option pools, flash-loaning capital to purchase options, causing vault collateral to lock into those pools, then withdrawing the collateral as liquidity. Two transactions executed roughly one second apart. PeckShieldAlert reported the exploiter bridged the stolen funds from Arbitrum to Ethereum, then swapped them to BTC via Chainflip and NEAR Intents. Blockaid initially flagged ~$400.5K across the two transactions while the attack was ongoing; later figures settled around $437K–$464.6K depending on pricing snapshot. Affected vaults included WBTC, WETH, and ARB call and put options. Collateral in the targeted vaults was nearly depleted post-attack.

Protocol / chain / asset: PremiaLabs decentralized options protocol on Arbitrum. Assets extracted included WBTC, WETH, USDC.e, and ARB. No core protocol logic beyond the vault/option-pool interaction appears to have been the root; the attack abused pool creation and liquidity withdrawal mechanics.

Loss: PeckShieldAlert: $464.6K. Other contemporaneous estimates: ~$437K (The Defiant / KuCoin analysis of net outflows) and ~$400.5K (Blockaid mid-attack). Live scored figure used here is ~$465K. Funds moved cross-chain and partially converted to BTC.

Attack type: Options vault / pool mechanics abuse via empty pool creation, flash loans, and liquidity extraction. Not a classic reentrancy or oracle manipulation; closer to an economic or accounting edge case in how vault collateral interacts with option pools.

Explorer URLs: Exploiter EOA: https://arbiscan.io/address/0xbeBa8CEfD0D75d747C5AD966Dc17C0Bb60D84dBd. Custom exploit contract: https://arbiscan.io/address/0x577168C8c6fA937495C3D6961f1d7D734b2d785f. Example exploit tx: https://arbiscan.io/tx/0x64602cbbeba5d3c7a5e2cff4f98cc118886fc6051c56fa50458abec2c90441ac. Victim vaults (examples): https://arbiscan.io/address/0x45dF5EA836A15B561937Ae8373ab9eE984aea531, https://arbiscan.io/address/0xbae43c546DFADC69576aE73C68e0694A54F08e1B, https://arbiscan.io/address/0xD46993F25D298ebbCD31E941156C66f7e628A52a. Arbiscan: https://arbiscan.io/.

Status: Detected by Blockaid while ongoing. Funds bridged and swapped toward BTC. No official Premia postmortem or recovery announcement at cutoff. Treat as confirmed drain of the reported amount.

Sources: https://x.com/PeckShieldAlert/status/2116758393067340132; Blockaid thread: https://x.com/blockaid_/status/2116745378674463229; Sprunky forensic: https://x.com/sprunky_eth/status/2116788691972599910.

Troves — Starknet — ~8.6 BTC — legacy rebalancing contract retained permissions

What happened: On 31 October 2026, approximately 8.57 WBTC-equivalent was removed from the Troves xWBTC/WBTC vault on Starknet. Troves stated the exploit involved a legacy rebalancing contract that retained permissions after being replaced. The team revoked the relevant contract permissions within roughly 40 minutes of discovery and paused the affected vault plus two others (xSTRK/STRK, xstrkBTC/strkBTC) as a precaution. An on-chain message from Troves (mirrored via DefimonAlerts) offered a 1 WBTC white-hat bounty for return of the remaining funds (less the bounty) to 0x91926046e148c66869d71B9Fa37306e82DDc8934, open until 3 November 2026 23:59 UTC. Transaction referenced: 0x0634307777205294f636d481808a7b9a9e208415a26dd19c8ada269b9332e330.

Protocol / chain / asset: Troves automated DeFi strategies on Starknet. Asset: WBTC / xWBTC vault collateral. Limited to this vault according to the project; other vaults paused prophylactically. No impact identified on remaining vaults at the time of the update.

Loss: Preliminary ~8.57–8.6 WBTC-equivalent. At contemporaneous BTC prices near $78K this is roughly $670K. Scored as ~8.6 BTC. White-hat offer of 1 WBTC outstanding.

Attack type: Lingering access control / permission retention on a replaced (legacy) rebalancing contract. Classic upgrade hygiene failure: old contract not fully deauthorized. Not a novel vulnerability in new code.

Explorer URLs: Referenced Starknet tx: 0x0634307777205294f636d481808a7b9a9e208415a26dd19c8ada269b9332e330 (Starkscan or Voyager). Recovery address on Ethereum: https://etherscan.io/address/0x91926046e148c66869d71B9Fa37306e82DDc8934. Starknet explorer: https://starkscan.co/ or https://voyager.online/.

Status: Contained by permission revocation and vault pauses. White-hat bounty offered. Investigation ongoing; detailed postmortem and depositor options promised after verification. No confirmed return of funds at cutoff.

Sources: Troves official: https://x.com/trovesfi/status/2116541963755475375; DefimonAlerts on-chain message: https://x.com/DefimonAlerts/status/2116543245211587053.

b14g — Core — ~97M CORE (~$1.47M) — zero-amount withdrawal treated as full balance

What happened: On 31 October 2026 at approximately 09:29 UTC, an attacker drained roughly 97.05 million CORE from 91 staking orders on b14g, a Bitcoin dual-staking / yield protocol on the Core chain. The attacker submitted withdrawal requests asking for 0 CORE from each order. Core’s staking contract (CoreAgent) interprets a zero amount as a request for the full staked balance of the order/staker. b14g’s contract passed the zero requests through, resulting in full payouts to the attacker-controlled wallet. The incident was confirmed by b14g and Core DAO on 31 October, with additional updates and network-safety statements continuing into 1 November. Approximately 68 million CORE remained on-chain as of official tracing; exchanges froze roughly 9 million. BTC staked through b14g (time-locked on Bitcoin) was unaffected. Core DAO stated the Core network, consensus, validators, and directly staked CORE were not compromised.

Protocol / chain / asset: b14g dual-staking protocol on Core. Asset: CORE tokens staked via b14g orders. Limited to CORE staked through b14g; direct validator stakes and BTC side unaffected. Attacker addresses reported by b14g: 0xc556ed208285406d71705927f92d4f4eaea579f1 and 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c.

Loss: ~97.05M CORE, valued at approximately $1.47M at contemporaneous prices (~$0.0151). Official project figure ~97M CORE. ~68M remaining on Core at time of statements; ~9M frozen by exchanges. Live scored figure ~$1.47M.

Attack type: Logic / accounting edge case in withdrawal path: zero-amount request interpreted as full-balance withdrawal by the underlying staking contract, combined with insufficient validation in the b14g wrapper. Not a private-key compromise or unauthorized code upgrade. Classic input-validation failure on an amount parameter.

Explorer URLs: Attacker addresses (as reported): https://scan.coredao.org/address/0xc556ed208285406d71705927f92d4f4eaea579f1, https://scan.coredao.org/address/0x27758c30f8e424fbd8ca605bf31e9496c26ce92c. Core explorer: https://scan.coredao.org/. Detailed on-chain reconstruction available via Bitquery investigation.

Status: Contracts paused by b14g shortly after discovery. Coordination with Core DAO, security partners, and exchanges for tracing and freezes ongoing. No full technical postmortem released at cutoff. Majority of funds still on-chain according to official statements. Treat as confirmed drain of the reported CORE amount.

Sources: b14g security update: https://x.com/b14g_network/status/2116570456245596580; Core DAO statement: https://x.com/Coredao_Org/status/2116582149101121618; Bitquery investigation: https://bitquery.io/investigations/b14g-hack.

Also noted

• Binance hot-wallet signing-access compromise (UPDATE, not re-scored): The ~$6.3 billion multi-chain drain from 29 October remains on prior briefs. On 1 November the labeled hacker addresses continued moving funds, including swapping hundreds of thousands of SOL (~$46M+ in recent batches) for BTC via RelayProtocol. Binance reopened BTC withdrawals on the Bitcoin network and began phased restoration of other assets. Approximately $3B remains frozen by issuers/partners; Binance has reserved company funds to cover user losses. No material new loss figures used for scoring today. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/. Lookonchain updates: https://x.com/lookonchain/status/2116841508599144917, https://x.com/lookonchain/status/2116792207076434170.
• Prior items (not re-scored): Flap/Kintsu DNS hijack wave (31 Oct), zkLink Nova Arbitrator, Avalanche TranchePool, and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol exploits with fresh scored loss figures beyond Premia, Troves, and b14g.

Sources and references

• PeckShieldAlert Premia: https://x.com/PeckShieldAlert/status/2116758393067340132
• Blockaid Premia thread: https://x.com/blockaid_/status/2116745378674463229
• Sprunky Premia forensic: https://x.com/sprunky_eth/status/2116788691972599910
• Troves official statement: https://x.com/trovesfi/status/2116541963755475375
• DefimonAlerts Troves on-chain message: https://x.com/DefimonAlerts/status/2116543245211587053
• b14g security update: https://x.com/b14g_network/status/2116570456245596580
• Core DAO on b14g: https://x.com/Coredao_Org/status/2116582149101121618
• Bitquery b14g investigation: https://bitquery.io/investigations/b14g-hack
• Lookonchain Binance hacker SOL swaps: https://x.com/lookonchain/status/2116841508599144917
• 30 Oct brief for Binance/Polymarket coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh loss figures in the last 24 hours beyond the three scored items.

Editor’s note: the scored live loss on this card is ~$2.6M. Newly reported or materially updated items are the PremiaLabs Arbitrum options vault drain (~$465K), the Troves Starknet xWBTC vault drain (~8.6 BTC) via lingering legacy permissions, and the b14g Core dual-staking drain of ~97M CORE (~$1.47M) via zero-amount withdrawal interpretation. Binance remains an UPDATE and is not re-scored. No how-to or exploit reproduction steps. Stay tuned or stay rekt.