Attacker Drains Avici User Card Balances in Live Solana Attack

An attacker drained Avici user card balances in real time on Aug. 28 by registering new administrators on collateral accounts and withdrawing balances on Solana. Early on-chain tracking by The Defiant and pseudonymous analyst STACC put the attacker's haul above $1 million and counted at least 125 affected accounts, with losses ranging from about $9 to more than $26,000. Avici later confirmed the attack drained $500,859.22 from 1,685 of its users' card balances, part of a wider exploit of contracts run by Rain, the card issuer behind Avici's Visa product. The flaw sat in an outdated Rain contract, not in Avici's own code, and not in passkey authorization as first suspected. At 18:58 UTC, the attacker's wallet held approximately 10,005.03 SOL (worth roughly $1.07 million at that time) plus about $11,600 in USDC and USDT. That figure reflects everything the wallet took across Rain-linked programs, not Avici losses alone. In the previous 11 minutes alone, the attacker's SOL balance had grown by about 2,595 tokens, roughly $277,000. The wallet had been funded with 1.79 SOL bridged through deBridge at 13:40 UTC and sat idle for three hours before its first call against Avici's contracts arrived at 16:49:48 UTC. The attacker signed 14,672 transactions total, with 2,344 failing, according to The Defiant. The attack pattern repeats per victim across three instructions: SubmitSignatures on an authorization program (which invokes Solana's Ed25519 signature verification precompile), AddCollateralAdmin on a collateral program, and WithdrawCollateralAsset on the same program. Both programs belong to Rain's card infrastructure. In one reviewed transaction, a single WithdrawCollateralAsset call moved 2,346.77 USDT from a user's collateral account to the attacker's token account. One SOL swap converted stablecoins into 209.76 additional SOL. Avici acknowledged the attack at 18:42 UTC in a post stating it is "working directly with all relevant partners to resolve it and will share updates as soon as we have more information," per The Defiant. That acknowledgment came one hour and 53 minutes after the first drain transaction. Users had been posting about missing balances before Avici's official response; at 18:44 UTC, one user wrote: "i just got drained of all my balance from my @avici acc, waiting to hear from the project." Both drained programs are upgradeable and share the same upgrade authority, a plain Solana account rather than a multisig, per The Defiant's technical analysis. As of Aug. 28, Avici had not yet disclosed how funds were taken or how many accounts were affected; its confirmation and a full refund pledge followed on Aug. 29. AVICI token traded at $0.2175 on Aug. 28, down 49.4% over 24 hours, with a market capitalization of $2.84 million on $656,543 of 24-hour volume, according to CoinGecko. The token set a record low on Friday, having reached $7.56 on Nov. 26, 2025. AVICI trades mostly on MetaDAO's futarchy automated market maker, which handles about 58% of volume, with the rest split across LBank, KCEX, and MEXC. AVICI now trades at about 62% of its ICO price.