Premia Labs, the on-chain development firm behind derivatives exchange Kyan, has lost $464,000 in a recent attack. According to security firm Blockaid, the attacker manipulated Premia Labs' vaults and obtained flash loans using fake trading pools, tricking the firm into releasing liquidity worth over 100 ETH.
The stolen funds were bridged from Arbitrum to Ethereum and then swapped and cashed out through NEAR Intents and Chainflip, according to Web3 security firm PeckShield. Both platforms are cross-chain orchestration services that can shield users' funds and limit the traceability of transactions.
Evolving Laundering Patterns in Crypto Hacks
The Premia Labs breach exemplifies a broader trend in cryptocurrency theft. Security analysts have identified a consistent pattern: attackers drain victims, move funds through DeFi lending protocols and cross-chain swaps, then cash out or shield assets on privacy-focused platforms.
Recent high-profile incidents demonstrate the sophistication of these operations. In the Binance hack, the attacker swapped $365 million in USDT into ETH and routed funds through THORchain and other platforms. Stolen funds from the Bitget hack and Ledger supply chain exploit have similarly been moved to Zcash shielded pools, making it increasingly difficult to distinguish legitimate transactions from illicit ones.
The Federal Bureau of Investigation has urged DeFi operators to help freeze stolen funds passing through their systems, raising potential legal and regulatory implications for the sector.
Scale and Attribution
Cryptocurrency hack losses have reached $8.73 billion annually, with additional October victims including Polymarket, PredictFun, and CoinDCX. Security researchers have documented that North Korean-based threat actors account for nearly 90 percent of hacks in 2026, marking a significant increase from the 15 percent share recorded in 2021.
