Solana Neobank Avici Confirms 1,685 Users Lost $500,859 in Rain Card Contract Exploit

An attacker exploited a vulnerability in Rain's Solana card issuer contract on Friday, draining $500,859.22 from 1,685 Avici user card balances, according to The Defiant. Avici pledged full refund to all affected users. The flaw sat in a contract belonging to Rain, the card issuer behind Avici's Visa product, not in Avici's own code. Avici's self-custodial wallets remained untouched. Only the separate contract holding balances users top up their cards with was drained. Rain said its monitoring systems detected a vulnerability in a small number of programs running an outdated version of its Solana contracts and upgraded every affected program. The company engaged third-party forensics experts to investigate and committed to working with law enforcement and regulatory authorities. Avici filed a report with the FBI's Internet Crime Complaint Center. On-chain records show the attacker's wallet received 1.79 SOL bridged through deBridge at 13:40 UTC Friday, sat idle for three hours, then launched its first call against the card contracts at 16:49:48 UTC. The attacker signed 14,672 transactions, 2,344 of which failed. The exploit pattern used three instructions per victim: SubmitSignatures, invoking Solana's Ed25519 signature-verification precompile, AddCollateralAdmin, and WithdrawCollateralAsset. In one reviewed transaction, a single WithdrawCollateralAsset call moved 2,346.77 USDT from a user's collateral account into the attacker's token account, per The Defiant's analysis. Both vulnerable programs are upgradeable and share the same upgrade authority: a plain Solana account rather than a multisig. The attacker moved 10,000 SOL (about $1.07 million at SOL's $106.62) from the drain wallet at 19:02:45 UTC while the drain was still running. The wallet was empty by 19:26:34. The receiving address split the balance into 6,999.98 SOL and 2,999.99 SOL sent to two further addresses, which now hold 82,910 and 110,472 SOL respectively and sign thousands of transactions per hour carrying memecoin balances, a profile consistent with exchange or market-maker hot wallets, according to The Defiant's on-chain review. Avici's first public statement came at 18:42 UTC, one hour and 53 minutes after the first drain transaction began. AVICI now trades at roughly 62 percent of that ICO price and carries a $2.84 million market capitalization on $656,543 of 24-hour volume, with the majority of trading concentrated on MetaDAO's futarchy automated market maker. Rain settles card transactions with Visa in stablecoins and issues cards for Western Union's Stablecard, launched August 4. Avici, registered in San Francisco, does not name its team on its website.