coindesk.com
A vulnerability in an outdated Rain card contract drained roughly $1.1 million across several Solana-based programs, including $500,800 from 1,685 Avici users, sending the neobank’s AVICI token down as much as 49%.
AVICI — a self-custodial neobank that enables users to spend their crypto via a Visa-integrated credit card — fell from a 24-hour high of $0.43 to a record low of $0.217 before recovering to around $0.378 at the time of writing.
Tria, another crypto neobank, reported that 636 users were affected, resulting in losses totaling more than $430,000. It vowed to repay users in full, even as its token plunged by more than 10% at one point.
Avici said the attack was confined to a Solana contract holding funds after customers topped up their cards. Its self-custodial wallets on Solana and Ethereum-compatible networks were not affected, and the company said every affected card balance would be refunded.
Rain said its monitoring identified the vulnerability in an outdated contract version used by Avici and a small number of other programs. It upgraded every program running that version and reported no further unauthorized activity.
Avici’s terms identify Third National as the card issuer, while Rain, a Visa principal member, provides the underlying stablecoin card infrastructure.
Transaction data show the attacker repeatedly submitted a signed authorization, added itself as an administrator to individual card-collateral accounts, and withdrew their balances. The stolen stablecoins were swapped into solana (SOL), bridged to Ethereum and ultimately sent through crypto mixer Tornado Cash.
The difference between the roughly $1.1 million traced onchain and Avici’s reported loss indicates other Rain-powered programs were also hit.
Neither company has identified those programs or disclosed the total amount each lost.
The incident exposes the custody handoff behind some self-custodial crypto cards. Users controlled money held in Avici wallets, but funds loaded for spending moved into a third-party contract.
That distinction is becoming more material as tracked crypto-card spending more than tripled to $1.04 billion in July, with stablecoins funding 70% of more than 10 million transactions.
Avici said it filed a report with the Federal Bureau of Investigation’s Internet Crime Complaint Center. It has not been said when the refunds will arrive or how they will be funded.