What happened
On August 28, 2026, an attacker exploited a legacy Solana card-balance contract supplied by Avici's card-issuing partner, Rain. Avici's reconciliation reported $500,859.22 in unauthorised withdrawals from the card balances of 1,685 users.
The affected balances were held in a separate contract after users topped up their cards. Avici said its self-custodial Solana and EVM wallets were not affected. Rain upgraded the affected contract version across the programs using it, and Avici said it had observed no further unauthorised activity.
Avici said every affected card balance would be refunded in full and that it had filed a report with the FBI's Internet Crime Complaint Center. This is a refund commitment, not confirmation that stolen funds were recovered on-chain.
Public reporting indicates an authorisation / signature-validation boundary failed in an outdated Rain collateral contract. The observed sequence submitted signatures, added a collateral administrator, then withdrew funds from card-balance accounts. Rain and Avici have not published a complete technical post-mortem identifying the exact defective condition.
How it happened
- The attacker targeted the legacy Solana contract that held funds users had moved into their Avici card balances.
- Transaction reporting shows repeated signature-submission calls followed by
AddCollateralAdmin, creating an unauthorised administrator path for collateral accounts. - The attacker then invoked
WithdrawCollateralAssetto move card-balance assets out of affected accounts.
The confirmed Avici reconciliation covers 1,685 users and $500,859.22 in card balances. Early on-chain estimates were higher and should not be treated as Avici's final loss figure. The separate self-custodial wallet product was outside the affected contract boundary.
Rain upgraded the vulnerable contract version; Avici committed to make affected card-balance users whole.
Protocol details
Market Context at Time of Hack
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
