Solana neobank Avici loses $1.1 million in crypto card hack, token crashes 49%

On August 28, 2026, a vulnerability in an outdated Rain card contract led to a $1.1 million exploit across Solana-based neobanks, draining $500,800 from 1,685 Avici users and over $430,000 from Tria users. The attacker bypassed security by adding themselves as an administrator to card-collateral accounts, subsequently laundering the funds via Tornado Cash. Following the breach, the AVICI token crashed 49% to an all-time low of $0.217. Both Avici and Tria have pledged full refunds to affected customers, and Avici has filed a complaint with the FBI.

Avici security breach

• ▪A security breach on August 28, 2026, targeted the Solana-based neobank Avici, draining $500,800 from 1,685 user card-collateral accounts.
• ▪The security breach at Avici was confined to a Solana smart contract holding card-funding balances, leaving self-custodial wallets on Solana and Ethereum-compatible networks unaffected.

Rain contract vulnerability

• ▪A vulnerability in an outdated Rain card smart contract led to approximately $1.1 million being drained across multiple Solana-based programs.
• ▪The attacker exploited the Rain contract by submitting signed authorizations, adding themselves as an administrator to card-collateral accounts, and withdrawing the balances.
• ▪Rain upgraded all programs running the compromised legacy contract version and reported no further unauthorized activity after identifying the vulnerability.
• ▪The neobank Tria, which also uses Rain infrastructure, suffered over $430,000 in losses affecting 636 users during the same contract exploit.

AVICI token crash

• ▪The native token of the neobank Tria temporarily declined by more than 10% after the security incident became public.
• ▪Following the security breach, the AVICI token plummeted up to 49% from its 24-hour high of $0.43 to an all-time low of $0.217.

Tornado Cash laundering

• ▪On-chain data showed the attacker's wallet was funded through the deBridge cross-chain bridge and held approximately 10,005 SOL and $11,600 in stablecoins.
• ▪The attacker converted the stolen stablecoins into Solana (SOL), bridged them to Ethereum, and laundered the funds through the crypto mixer Tornado Cash.

FBI complaint filing

• ▪Avici has not disclosed when the customer refunds will be distributed or how those reimbursements will be funded.
• ▪Avici filed an official cybercrime report regarding the security breach with the Federal Bureau of Investigation’s Internet Crime Complaint Center.

Customer reimbursement pledges

• ▪Avici pledged to provide full refunds to all 1,685 affected users for their compromised card balances.
• ▪Tria committed to fully reimbursing its 636 affected customers for the losses they experienced during the exploit.

3 sources