Premia Labs, the on-chain development firm behind the derivatives exchange Kyan, has been drained of $464K (131 ETH).
According to security firm Blockaid, the attacker manipulated Premia Labs’ vaults, got flash loans using fake trading pools, tricking the firm into releasing liquidity worth over 100 ETH.
The stolen funds were bridged from Arbitrum to Ethereum and then swapped and cashed out through NEAR Intents and Chainflip, according to PeckShield, another Web3 security firm.
Crypto hackers upgrade laundering operations
The laundering mechanism underscores a trend observed across recent hacks. After the attacker drains a victim, the next hop is a DeFi lending protocol, cross-chain swaps, and direct cash-out or shielding funds on privacy protocols.
NEAR Intents and Chainflip are cross-chain orchestration platforms that also shield users’ funds. They also limit traceability of stolen funds and potential blocks or freezes.
Notably, the Binance hacker leveraged Aave and Uniswap to swap $365M USDT into unfreezable ETH funds and sent them to THORchain and other platforms for final cash-out.
Similarly, stolen funds from the Bitget hack and the Ledger supply chain exploit have hit Zcash shielded pools. As such, one can hardly tell or separate legitimate funds from stolen ones.
In fact, the U.S. FBI has flagged and made a call to DeFi operators to help freeze stolen funds going through their systems. For security experts, the clarion call may also come with increased DeFi scrutiny and legal implications for DeFi operators.
Can automated transfers overwhelm crypto investigators?
Unfortunately, the attackers, especially the one behind the Binance exploit, have deployed AI-enabled operations. The attacker, now confirmed as North Korea-backed TraiderTraitor, has automated splitting of funds into new addresses.
He then repeatedly rotated them amongst many other addresses and sent them to various DeFi swap venues.
In fact, Chainalysis said it was a unique new pattern.
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit.
And the goal? To bounce off and overwhelm the on-chain trackers and fry the GPU used to track hackers. Think of it as a jammer or a denial-of-service attack against security trackers.
That said, the total crypto losses from hacks have hit an annual record of $8.73B. Other victims in October include Polymarket, PredictFun, and CoinDCX.
But North Korea-based threat actors account for nearly 90% of the hacks in 2026. That’s nearly 6x growth from 2021’s 15% share. Simply put, North Korea remains crypto’s biggest risk factor.
Final Summary
- Premia Labs suffered a $464K breach, and the attacker laundered the funds via NEAR Intents and Chainflip
- Crypto hack losses have risen to nearly $9B in 2026, with 90% driven by North Korean threat actors