Avici Card Contract Drain

What happened

On 28 August 2026, Avici, a Solana-based neobank, said its card-issuing partner Rain had identified a vulnerability in an outdated version of a Solana card contract holding user card balances. Avici puts the amount drained at $500,859.22 across 1,685 affected users, all of whom it says will be refunded in full. The contract was upgraded across all programs, no further unauthorised activity has been observed, and a report was filed with the FBI's IC3.

The attackers used the contract's SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset functions; self-custodial wallets were untouched. SlowMist's database logs the same $500,859.22. Separate on-chain tallies circulating the same day put the theft above $1m, counting 10,005.03 SOL, roughly $1.07m, plus about $11,600 in stablecoins taken from 125 sending accounts in 14,672 attempted transactions from 16:49:48 UTC. Those tallies have not been reconciled with Avici's card-contract figure, and the smaller company number is the one logged here. The AVICI token fell 49.4 per cent to an all-time low of $0.2175.