The crypto bank project Avici announced that its card issuing partner Rain discovered a vulnerability in the old version of the Solana card contract still used by a few other projects. All related programs have been upgraded, and no new unauthorized operations have been observed.

Avici's reconciliation shows that 1,685 users had their card balances drained, totaling $500,859.22, and they have promised full refunds. They have also reported the incident to the FBI's Internet Crime Complaint Center. The company emphasized that the attacked contract was an independent contract holding the card balance after recharge, and users' self-custodied Solana and EVM wallets were not affected. Rain, as a Visa member providing stablecoin card infrastructure to several new banks, stated that it has upgraded all programs still running the old version of the contract, hired a third-party forensics team, and that affected users will be compensated. Other projects under the same contract, such as Tria, have also been flagged by researchers for drained balances.

On-chain analysis and official statements differ regarding the total amount moved by the attacker. The address FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj injected about 1.79 SOL, starting with approximately $190, at 13:40 UTC via deBridge, and began interacting with Avici-related programs at 16:49. The path involved SubmitSignatures, writing itself as the collateral account administrator with AddCollateralAdmin, and then WithdrawCollateralAsset to withdraw balances; a single transaction once drained 2,346.77 USDT. By 18:58, this address held about 10,005 SOL plus approximately $11,600 in stablecoins; at 19:02, it transferred out a full 10,000 SOL, about $1.07 million, and by 19:26, it was emptied. The funds were converted to about $1.02 million USDC and crossed chains, with approximately 418 to 456 ETH entering a new Ethereum address, then deposited into Tornado Cash between 19:20 and 20:00. The address signed approximately 14,672 transactions, with 2,344 failures. The median loss per user in Avici was about $24, with the largest single loss around $5,268.

Early monitoring reported the incident as the native token AVICI being hacked, with losses around $1.02 million, indicating that the attacker converted the drained assets into SOL, then into USDC and ETH, rather than directly stealing AVICI from self-custodied wallets. The token price has also been impacted, dropping as much as 49.4% in 24 hours to about $0.2175, a decline of approximately 97% from the peak of $7.56 on November 26, 2025. Avici had previously raised funds through MetaDAO in October 2025, with a cap of $3.5 million and a fully diluted valuation of about $4.515 million.

Rain did not specify how long the old contract had been deployed, why it was not upgraded in advance, or how the attacker identified the programs still using the old version. A timeline for refunds has not been announced. The funds have entered a mixer, and on-chain tracing has shifted to the exchange deposit side.

In market mechanics, the buyer is the user who deposits stablecoins into the card balance contract to use Visa, while the seller is the infrastructure provider sharing the same expired card issuing program. The attack was driven by a flaw in authorization verification: the second signature verification was incorrectly routed to the first instruction, causing the attacker's signature to be treated as a legitimate administrator. Funds flowed from the user card balance to the attacker's token account, then exited via bridges and mixers. The beneficiaries are the attacking addresses that can bulk assign themselves as administrators, while the burden falls on cardholders who have moved money from their self-custodied wallets into shared contracts, as well as the AVICI holdings that dropped in price; the promise of refunds temporarily shifts the hole onto the project and Rain's balance sheets.

Source: Public Information