Avici card balances hit by Solana contract vulnerability affecting 1,685 users

Aug 28, 2026

On August 28, 2026, an exploit targeting an outdated Solana card contract by card issuer Rain drained $500,859.22 from 1,685 users of the neobank Avici. The attacker escalated privileges to register as an administrator on collateral accounts before withdrawing funds, eventually moving 10,000 SOL. Both Avici and Rain promised full refunds to affected users, while the native AVICI token crashed by up to 49% to a record low of $0.2175.

Avici card balance exploit

▪Avici's self-custodial Solana and EVM wallets remained untouched and under user control during the August 28, 2026 exploit
▪The exploit of Avici's card balances on August 28, 2026, resulted in a loss of $500,859.22 in user funds
▪On August 28, 2026, an attacker drained card balances from Avici, a Solana-based neobank, affecting 1,685 users

Rain Solana contract vulnerability

▪Rain, which issues Visa cards for Avici, also issues cards for Western Union's Stablecard, which launched on August 4, 2026
▪Rain identified the contract vulnerability on August 28, 2026, and upgraded the Solana contract across all affected programs to halt unauthorized activity
▪The August 28, 2026 exploit occurred due to a vulnerability in an outdated version of a Solana card contract belonging to Rain, Avici's card-issuing partner

Attacker admin privilege escalation

▪The attacker initiated the August 28, 2026 exploit by calling SubmitSignatures on the authorization program, which invoked Solana's Ed25519 signature-verification precompile
▪During the August 28, 2026 exploit, the attacker called AddCollateralAdmin on the collateral program to register itself as an administrator on users' collateral accounts

Fund withdrawal through collateral accounts

▪The attacker's wallet, funded with 1.79 SOL bridged through deBridge, signed 14,672 transactions during the August 28, 2026 exploit
▪After gaining administrator privileges during the August 28, 2026 exploit, the attacker called WithdrawCollateralAsset to withdraw balances from users' collateral accounts
▪The attacker's wallet transferred exactly 10,000 SOL, worth approximately $1.07 million, in a single transaction at 19:02:45 UTC on August 28, 2026

Full user refund commitment

▪Rain engaged third-party forensics experts to investigate the August 28, 2026 exploit and committed to working with law enforcement and regulatory authorities
▪Avici filed a report regarding the August 28, 2026 exploit with the FBI's Internet Crime Complaint Center
▪Following the August 28, 2026 exploit, both Avici and Rain committed to fully refunding all 1,685 affected users for their lost card balances

AVICI token price crash

▪The AVICI token's record low of $0.2175 represents a decline of approximately 96% from its peak of $7.56 on November 26, 2025
▪Following the August 28, 2026 exploit, the native AVICI token fell by approximately 39% to 49% over 24 hours, reaching a record low of around $0.2175