On-chain monitoring shows that an address associated with Avici transferred out 10,000 SOL, exchanged for approximately $1.02 million USDC, and then cross-chain converted to about 418 ETH, with the funds traced to a mixing protocol deposit address.

The figures from the project team do not completely align with the monitoring data. Avici claims the vulnerability lies in an outdated Solana contract from the card issuer Rain, rather than its own code; the affected funds are from an independent balance contract for users' Visa card top-ups, with self-custody wallets remaining untouched. Reconciliation indicates that 1,685 users had a total of $500,859.22 taken from their card balances, with a promise of full compensation, and a report has been filed with the FBI's Internet Crime Complaint Center. Rain stated that monitoring found a small number of programs still running the old contract, which have now all been upgraded. The same attack address transferred exactly 10,000 SOL and emptied within about 24 minutes, amounting to approximately $1.07 million at the time; it was then split and entered into exchanges and cross-chain transactions. The AVICI token dropped by about 30% to 50% during trading. Neither party has clarified how long the old contract had been deployed, why it was not upgraded in time, or how the attacker was able to locate it.

The funds taken were from the card-side custodial balance, not the settlement network itself. The compensation promise shifts the liability from users to the project's and issuer's balance sheets; if the funds have already entered the mixing deposit, the window for recovery shrinks by the hour. The exchange's hot wallet characteristic address had received the split SOL, and whether a freeze decision was completed will affect the speed of liquidation.

Market-wise, this represents a trust discount after the card balance contract was drained, not a public chain outage. Buyers are shorting AVICI and avoiding similar "on-chain new banks," while sellers are holders who have not exited and cardholders waiting for compensation. Funds moved from user card balances to the attack address, then left Solana's ledger via stablecoins and cross-chain. Beneficiaries are those who can quickly mark addresses through monitoring and exchange risk control, while those under pressure are users treating the top-up contract as a bank account and other integrators treating Rain's old program as infrastructure. Compensation can restore numbers but cannot recover the operational record of "the upgrade key being inactive for a long time and the old version still running."

In supplementary statements, the project emphasizes that self-custody was not compromised, delineating the incident's boundary to the card issuer contract; the total on-chain amount exceeds its reconciled card balance, with the difference arising from other exposures or valuation points along the path.

Source: Public Information