Crypto Bank Avici Loses Approximately $1.02 Million Due to Exploit
On-chain monitoring shows that an address associated with Avici transferred out 10,000 SOL, exchanged for approximately $1.02 million USDC, and then cross-chain converted to about 418 ETH, with the funds traced to a mixing protocol deposit address.
The figures from the project team do not completely align with the monitoring data. Avici claims the vulnerability lies in an outdated Solana contract from the card issuer Rain, rather than its own code; the affected funds are from an independent balance contract for users' Visa card top-ups, with self-custody wallets remaining untouched. Reconciliation indicates that 1,685 users had a total of $500,859.22 taken from their card balances, with a promise of full compensation, and a report has been filed with the FBI's Internet Crime Complaint Center. Rain stated that monitoring found a small number of programs still running the old contract, which have now all been upgraded. The same attack address transferred exactly 10,000 SOL and emptied within about 24 minutes, amounting to approximately $1.07 million at the time; it was then split and entered into exchanges and cross-chain transactions. The AVICI token dropped by about 30% to 50% during trading. Neither party has clarified how long the old contract had been deployed, why it was not upgraded in time, or how the attacker was able to locate it.
The funds taken were from the card-side custodial balance, not the settlement network itself. The compensation promise shifts the liability from users to the project's and issuer's balance sheets; if the funds have already entered the mixing deposit, the window for recovery shrinks by the hour. The exchange's hot wallet characteristic address had received the split SOL, and whether a freeze decision was completed will affect the speed of liquidation.
Market-wise, this represents a trust discount after the card balance contract was drained, not a public chain outage. Buyers are shorting AVICI and avoiding similar "on-chain new banks," while sellers are holders who have not exited and cardholders waiting for compensation. Funds moved from user card balances to the attack address, then left Solana's ledger via stablecoins and cross-chain. Beneficiaries are those who can quickly mark addresses through monitoring and exchange risk control, while those under pressure are users treating the top-up contract as a bank account and other integrators treating Rain's old program as infrastructure. Compensation can restore numbers but cannot recover the operational record of "the upgrade key being inactive for a long time and the old version still running."
In supplementary statements, the project emphasizes that self-custody was not compromised, delineating the incident's boundary to the card issuer contract; the total on-chain amount exceeds its reconciled card balance, with the difference arising from other exposures or valuation points along the path.
Source: Public Information
ABAB AI Insight
Avici sells an on-chain new bank with Visa, and the exploit targets the top-up contract rather than the card magnetic stripe. Rain's outdated Solana program provided an expired interface, leading to the draining of card balances for 1,685 users, with the project then using compensation to shift liabilities back to the company. The monitored $1.02 million and the official $500,000 do not match because the 10,000 SOL is the total outflow from the attack address, with the card balance being just a portion of it. The claim that self-custody was untouched is used to protect the core wallet narrative, while the top-up layer operates under the custodial account—users think they are topping up their cards, but the funds actually entered a pool callable by the old program.
The capital path is outsourced card issuance. Avici handles the front end and wallets, while Rain manages contracts and card tracks; the outdated program remains integrated in a few cases, with upgrade permissions left unused for a long time, effectively hanging the administrator key on the door. Cross-chain conversion to ETH and then into mixing deposits rewrites the traces on Solana's ledger to another settlement system. Reporting to the FBI is a compliance action that does not change the cost of tracking after mixing. The token's crash sets the pricing for the circulating supply, while compensation provides a nominal price for users, with both sets of accounts existing simultaneously.
A comparison can be made to other new banks that separate card issuance contracts and self-custody wallets, only safeguarding the latter. The industry is in a period of expansion for Visa-branded and on-chain balances. The old program not being taken offline is a more common failure mode for integrators than audit reports.
Structural changes represent a transfer of pricing power. Whoever controls the upgrade rights of the top-up contract controls the user card balances. The mechanism is: outdated programs leave administrator calls open to attackers; cross-chain cuts off single ledger tracing; compensation shifts credit risk back to the issuer from users. If the moat of a new bank is built on the version of partner contracts, then version lag is an exposure.
ABAB News · Cognitive Law
Self-custody was not lost, only indicating the wallet is still there, not that the top-up pool is still there
Outdated contracts not being upgraded is equivalent to leaving the administrator entry open for the next caller
Compensation fixes the balance numbers but cannot recover the time the upgrade key has been inactive