Crypto Bank Project Avici Discloses Card Contract Vulnerability and Promises Full Refund
The crypto bank project Avici announced that its card issuing partner Rain discovered a vulnerability in the old version of the Solana card contract still used by a few other projects. All related programs have been upgraded, and no new unauthorized operations have been observed.
Avici's reconciliation shows that 1,685 users had their card balances drained, totaling $500,859.22, and they have promised full refunds. They have also reported the incident to the FBI's Internet Crime Complaint Center. The company emphasized that the attacked contract was an independent contract holding the card balance after recharge, and users' self-custodied Solana and EVM wallets were not affected. Rain, as a Visa member providing stablecoin card infrastructure to several new banks, stated that it has upgraded all programs still running the old version of the contract, hired a third-party forensics team, and that affected users will be compensated. Other projects under the same contract, such as Tria, have also been flagged by researchers for drained balances.
On-chain analysis and official statements differ regarding the total amount moved by the attacker. The address FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj injected about 1.79 SOL, starting with approximately $190, at 13:40 UTC via deBridge, and began interacting with Avici-related programs at 16:49. The path involved SubmitSignatures, writing itself as the collateral account administrator with AddCollateralAdmin, and then WithdrawCollateralAsset to withdraw balances; a single transaction once drained 2,346.77 USDT. By 18:58, this address held about 10,005 SOL plus approximately $11,600 in stablecoins; at 19:02, it transferred out a full 10,000 SOL, about $1.07 million, and by 19:26, it was emptied. The funds were converted to about $1.02 million USDC and crossed chains, with approximately 418 to 456 ETH entering a new Ethereum address, then deposited into Tornado Cash between 19:20 and 20:00. The address signed approximately 14,672 transactions, with 2,344 failures. The median loss per user in Avici was about $24, with the largest single loss around $5,268.
Early monitoring reported the incident as the native token AVICI being hacked, with losses around $1.02 million, indicating that the attacker converted the drained assets into SOL, then into USDC and ETH, rather than directly stealing AVICI from self-custodied wallets. The token price has also been impacted, dropping as much as 49.4% in 24 hours to about $0.2175, a decline of approximately 97% from the peak of $7.56 on November 26, 2025. Avici had previously raised funds through MetaDAO in October 2025, with a cap of $3.5 million and a fully diluted valuation of about $4.515 million.
Rain did not specify how long the old contract had been deployed, why it was not upgraded in advance, or how the attacker identified the programs still using the old version. A timeline for refunds has not been announced. The funds have entered a mixer, and on-chain tracing has shifted to the exchange deposit side.
In market mechanics, the buyer is the user who deposits stablecoins into the card balance contract to use Visa, while the seller is the infrastructure provider sharing the same expired card issuing program. The attack was driven by a flaw in authorization verification: the second signature verification was incorrectly routed to the first instruction, causing the attacker's signature to be treated as a legitimate administrator. Funds flowed from the user card balance to the attacker's token account, then exited via bridges and mixers. The beneficiaries are the attacking addresses that can bulk assign themselves as administrators, while the burden falls on cardholders who have moved money from their self-custodied wallets into shared contracts, as well as the AVICI holdings that dropped in price; the promise of refunds temporarily shifts the hole onto the project and Rain's balance sheets.
Source: Public Information
ABAB AI Insight
New banks advertise "self-custody" and "card usability," but there must be a custodial bridge in between. Avici's bridge is Rain's Solana card balance contract: once money is deposited, it leaves the user's private key and enters a shared program. The vulnerability is not in the wallet, but in the old version of the authorization for this bridge. The attacker spent $190 to cross the bridge, writing themselves as the administrator for over a thousand collateral accounts, then withdrew funds one by one. This is the cost of infrastructure reuse—an expired bytecode supports multiple brands like Avici and Tria, and when one expires, many leak together.
The capital path is to first withdraw stablecoins, then convert them into SOL aggregated into whole tens of thousands, then convert to USDC to cross to Ethereum, and finally enter Tornado Cash. The 10,000 SOL corresponding to about a million dollars is a total across multiple projects, not just the $500,859.22 on Avici's books. The price difference indicates that Rain's old contract is a shared pipeline. Avici's report to the FBI's IC3 is because after mixing, the on-chain labels become ineffective, and identities must be traced back to deposit points like Gate, Kraken, or Coinbase. The token's halving is another accounting issue: market value is priced against security narratives, regardless of whether the vulnerability is in their own warehouse.
This is comparable to every incident of "partner contract expiration still in production" in card issuing and cross-chain bridge accidents. The industry stage is one of expansion with control failure: the Visa channel has already received on-chain stablecoins, but upgrade discipline has not reached the same release process. This is not a new bank being breached, but the old interfaces of card issuing middleware still being active.
The structural change is that technological replacement is incomplete. Self-custody has replaced platform custody of user wallets, but has not replaced the custodial balance required for card usage. The mechanism is: payment networks need instant deductions, and on-chain wallets cannot wait for merchant confirmations, so balances must be pre-stored in contracts that can be controlled by programs; an old contract with fewer signature verifications allows administrators to be forged. The promise of refunds turns technical debt into financial debt, and mixers turn financial debt into enforcement debt.
ABAB News · Cognitive Law
Self-custody stops at the step of depositing into the card
Expired versions of shared middleware leak together
Refund promises transfer liabilities, not already mixed coins