Avici to Refund 1,685 Users After Solana Card Exploit
Crypto neobank Avici will reimburse 1,685 users in full after a vulnerability in card infrastructure supplied by Rain exposed $500,859.22 in customer balances.
Summary:
- Avici says 1,685 users had $500,859.22 in card balances affected and will receive full refunds.
- The vulnerability was in a Solana card contract supplied by card-issuing partner Rain.
- Avici’s self-custodial Solana and EVM wallets were not compromised.
- Rain has patched the affected contract version, while Avici has reported the incident to the FBI.
The August 28 incident affected funds transferred into Avici’s card system, not assets held in its self-custodial wallets, and the vulnerable Solana contract has since been patched across programs using it.
Avici confirms 1,685 affected users
Avici disclosed the final customer count after reconciling accounts affected during the incident.
The company identified $500,859.22 in impacted card balances and said every affected user would be made whole.
That figure is lower than the estimates circulating while the exploit was still active. Coin Bureau and on-chain researchers initially tracked more than $1 million moving through addresses associated with the attack.
The figures measure different scopes. Avici’s number represents balances belonging to its customers, while the early blockchain estimates followed broader wallet activity. Rain’s vulnerable contract version was also deployed by a small number of other programs, including Tria, according to subsequent reporting.
Until Rain publishes a complete accounting across those deployments, the larger figure should not be presented as the amount lost specifically by Avici customers.
The confirmed impact at Avici:
- Affected users: 1,685
- Affected card balances: $500,859.22
- Reimbursement: 100% of affected balances
- Self-custodial wallets: Not affected
- Vulnerable infrastructure: Solana card contract supplied by Rain
- Current status: Contract patched across affected programs
The exploit was isolated to Avici’s card layer
The architecture of Avici’s product limited the reach of the attack.
Its Solana and EVM wallets are self-custodial, meaning users retain control over the assets stored in them. Avici said those wallets were never compromised.
Card balances operate separately.
When users fund their Avici cards, the money enters infrastructure associated with the card product. Rain, Avici’s card-issuing partner, provides the underlying system, including the Solana contract involved in the incident.
The vulnerability existed in an older version of that contract.
As a result, the attacker could access funds already allocated to card spending but could not reach assets remaining in users’ main self-custodial wallets.
That distinction is particularly relevant for crypto neobanks, where a single application can combine self-custody with services that rely on external providers. A product may appear unified to the customer even though different balances depend on different security models underneath.
A signature-validation flaw opened access to collateral accounts
Initial technical analysis indicates that the attacker exploited authorization logic rather than stealing customer private keys.
Researchers examining the transactions identified interactions involving Solana’s Ed25519 signature-verification mechanism and a function used to add administrators to card collateral accounts.
The vulnerable logic reportedly checked one of the required signatures against an incorrect instruction reference. That allowed a signature controlled by the attacker to satisfy an authorization condition that should have required separate approval.
After gaining administrative privileges, the attacker could invoke the withdrawal functionality attached to affected collateral accounts.
Initial on-chain analysis indicates the attack followed four main steps:
- Authorization request: The attacker interacted with the contract’s signature-verification process.
- Signature-check bypass: Faulty instruction handling reportedly allowed an authorization condition to be satisfied without the required separate approval.
- Administrative access: The attacker gained privileges that exposed withdrawal functionality for card collateral accounts.
- Repeated withdrawals: The same process was used across additional affected accounts to remove funds.
A full technical post-mortem from Rain would still be needed to establish precisely how the flaw entered production, how long the vulnerable contract remained active and what security reviews it underwent before deployment.
Rain patches the contract across affected programs
Rain has since upgraded the vulnerable contract version across the programs that used it, according to Avici.
The company said no further unauthorized transactions had been observed after the remediation.
The patch matters because the contract was not exclusive to Avici.
Rain provides card infrastructure to multiple fintech and crypto companies. Tria was also affected by the same incident and has said its users will be reimbursed, according to reporting from The Defiant.
This turns the event into a broader question about shared infrastructure risk.
Crypto applications increasingly outsource card issuance, payments, custody components and other specialized services to third-party providers. That can accelerate product development, but it also means a vulnerability in one infrastructure layer can surface simultaneously across otherwise unrelated consumer applications.
Avici’s wallet isolation prevented that shared vulnerability from spreading into its self-custodial product. The card balances, however, inherited the security assumptions of Rain’s infrastructure.
The attack wallet started with about $190
On-chain reconstruction also shows how little capital was required to initiate the operation.
Researchers reported that the attack wallet was created on August 28 and initially funded with roughly $190 in bridged USDC.
The wallet subsequently executed thousands of transactions as the attacker moved across collateral accounts.
Security researchers later tracked swaps involving SOL and USDC as the stolen assets were consolidated and moved through additional addresses. Some funds were eventually converted into ETH and sent toward Tornado Cash.
The sequence highlights an asymmetry common to smart-contract exploits: the attacker does not need capital remotely comparable to the value targeted. Once an authorization or accounting vulnerability provides access, transaction fees can be the primary upfront cost.
Full refunds shift attention to Rain’s post-mortem
Avici says affected customers will receive 100% reimbursement and has filed a report with the FBI’s Internet Crime Complaint Center.
For users, that removes the immediate financial loss if the refunds are completed as promised. For Avici and Rain, the remaining issue is explaining how the vulnerability reached production and whether existing security procedures should have detected it.
Rain’s post-mortem will therefore be more important than another estimate of attacker proceeds.
It should establish which programs deployed the affected contract, when the vulnerable version was introduced, whether it had been independently audited and what controls are being added beyond the immediate patch.
Those disclosures will determine whether the incident remains a contained card-contract failure or prompts broader changes in how crypto neobanks assess the third-party infrastructure sitting between self-custodial wallets and everyday payment products.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Kosta Gushterov
Reporter at CoinsPress
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
