Avici confirmed on August 28 that an attacker drained $500,859.22 from the card balances of 1,685 users, and that all affected users would be fully reimbursed. Crucially, the vulnerability does not reside in Avici’s code, but in the contracts of Rain—the Visa card issuer behind Avici and the infrastructure reportedly powering the majority of Solana neobanks.
Rain confirmed that its monitoring systems detected “a vulnerability affecting a small number of programs using an older version of the Solana contract” and upgraded every program running that version. Rain pledged that “all affected users will be fully compensated,” while engaging forensic specialists and coordinating with law enforcement. Avici stated that it has filed a report with the FBI (IC3). Avici’s self-custodial wallets were untouched; only the dedicated contract holding card top-up balances was drained.
The incident extends beyond Avici to several other neobanks. Tria also announced that it was under attack, and Solayer Pay was impacted. According to a list compiled by analyst inno_sol (which has not been independently confirmed by each project), neobanks reportedly running on Rain’s infrastructure include: etherfi Cash, Avalanche Card, Plasma One, Tangem Pay, Avici, KAST, Offramp, Currency, Dakota, Solayer Pay, Nuvei, Cadana, Wallbit, Takenos, Western Union Stablecard, Wyoming FRNT, Uniswap, Tria, XPlace, Oobit, Exa Card, Lava Card, Tuyo Card. Rain has not yet released a complete list of programs running the outdated contract.
Technical breakdown (according to The Defiant): the attacker was funded with 1.79 SOL via deBridge at 13:40 UTC, waited for three hours, and then initiated the exploit at 16:49. They signed 14,672 transactions (2,344 of which failed), repeating the same pattern for each victim: calling SubmitSignatures on the authorization program, then AddCollateralAdmin to register themselves as an admin on the user’s collateral account, and finally WithdrawCollateralAsset to drain the balance. Both programs were upgradeable and shared a single upgrade authority—a standard Solana account, rather than a multisig.
On-chain data indicates that actual losses exceed the figures announced by Avici: the attacker’s wallet (FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj) transferred exactly 10,000 SOL (~$1.07 million) at 19:02 UTC and was emptied by 19:26. The discrepancy aligns with the likelihood that multiple programs were running the flawed contract. According to BingX’s synthesis of analyst reports, the attacker also bridged ~$1 million in USDC from Solana to Ethereum via deBridge and laundered the proceeds through TornadoCash; Circle drew criticism for having more than two hours to freeze the funds but failing to take action.
Market reaction: AVICI dropped 49.4% over 24 hours to $0.2175—an all-time low, bringing its market cap to $2.84 million, a 97% decline from its peak of $7.56 in November 2025. The token rebounded by more than 50% following the announcement of full reimbursements.
The incident raises systemic questions for the crypto card industry: when dozens of neobanks rely on a shared issuance infrastructure, a single vulnerability at the infrastructure layer can trigger a domino effect, reminiscent of past bridge and shared-module exploits across other sectors. Users deposit funds onto crypto cards expecting bank-grade reliability; the supply chain behind those cards must now face scrutiny comparable to that of the banking industry.