Avici Says 1,685 Users Lost $500,859 In Rain Card Contract Exploit

Avici said an attacker took $500,859.22 from the card balances of 1,685 users on Friday, and that every affected user will be refunded in full.

The flaw was in a contract belonging to Rain, the card issuer behind Avici's Visa product, rather than in Avici's own code. Rain said its monitoring systems found "a vulnerability impacting a small number of programs using an outdated version of our Solana contracts" and that it has upgraded every program running that version. Avici said its self-custodial wallets were untouched: only the separate contract that holds balances users top their cards up with was drained.

Onchain records show the attacker moved more than that figure. The wallet behind the drain, FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, sent exactly 10,000 SOL — about $1.07 million at SOL's $106.62 — in a single transfer at 19:02:45 UTC, and was empty by 19:26:34. The gap fits Rain's account that more than one program ran the vulnerable contract.

Rain Says All Made Whole

Rain has "engaged third-party forensics experts to investigate, and will work with law enforcement and relevant regulatory authorities," it said at 20:26 UTC. "All affected users will be made whole."

Avici said it has filed a report with the FBI's Internet Crime Complaint Center. "We are deeply sorry for the concern and inconvenience this has caused," it said.

Neither company has said how long the outdated contract had been deployed, why the programs running it were not upgraded earlier, or how the attacker found it. Rain settles card transactions with Visa in stablecoins and issues cards for Western Union's Stablecard, launched Aug. 4.

A Rain spokesperson said in an emailed statement that, "customer security and trust are central to Rain and the monitoring systems we built allowed us to identify the situation quickly. Our teams coordinated with partners and acted swiftly to deploy a solution within two hours. We have also worked closely with our partners to make all users whole within 24 hours of the incident."

Add Admin, Then Withdraw

The wallet was funded with 1.79 SOL bridged through deBridge at 13:40 UTC and sat idle for three hours. Its first call against the card contracts landed at 16:49:48 UTC. It signed 14,672 transactions before going quiet, 2,344 of which failed.

The pattern repeats per victim across three instructions, according to transaction logs. The wallet first calls SubmitSignatures on the authorization program in a transaction that also invokes Solana's Ed25519 signature-verification precompile. It then calls AddCollateralAdmin on the collateral program, and finally WithdrawCollateralAsset on the same program. The attacker registers itself as an administrator on a user's collateral account, then withdraws the balance.

In one transaction reviewed by The Defiant, a single WithdrawCollateralAsset call moved 2,346.77 USDT out of a user's collateral account and into the attacker's token account. The wallet swapped the stablecoins it took into SOL as it went, one fill adding 209.76 SOL.

Both programs are upgradeable and share the same upgrade authority, a plain Solana account rather than a multisig.

Ten Thousand SOL, One Hop

The 10,000 SOL left the attacker's wallet at 19:02:45, while the drain was still running, and moved again 33 seconds later. The receiving address, MsaXH6cGDahPQDwJjFYod7RW8QLVDZGByywWvwQ9TFu, split the balance at 19:03:18 into 6,999.98 SOL and 2,999.99 SOL sent to two further addresses, then emptied itself.

Those two addresses hold 82,910 SOL and 110,472 SOL, sign thousands of transactions an hour and carry long lists of memecoin balances, a profile consistent with exchange or market-maker hot wallets.

Two Hours To Acknowledge

Avici's first public statement came at 18:42 UTC, one hour and 53 minutes after the first drain transaction, and said only that it was "aware of an issue affecting card balance withdrawals." Users had been posting about missing balances before it went up.

"i just got drained of all my balance from my @avici acc," one user wrote at 18:44 UTC. "waiting to hear from the project."

AVICI Halves To Record Low

AVICI traded at $0.2175, down 49.4% over 24 hours, with a market capitalization of $2.84 million on $656,543 of 24-hour volume, according to CoinGecko. The token set a record low on Friday, having reached $7.56 on Nov. 26, 2025.

The token trades mostly on MetaDAO's futarchy automated market maker, which handles about 58% of volume, with the rest split across LBank, KCEX and MEXC.

Refunded 90% At Launch

Avici raised through MetaDAO in October 2025 in one of the launches that revived the ICO on Solana. The team capped the sale at $3.5 million against $34,206,976 in commitments, refunding 89.8% of committed USDC and setting an initial price of $0.35 on a $4,515,000 fully diluted valuation across a 12.9 million token supply. AVICI now trades at about 62% of that ICO price.

The company, registered as Avici Inc. in San Francisco, does not name its team on its website. It said on Aug. 24 it would be among the first neobanks to offer Coinbase's tokenized stocks on Base.

Wallet-level compromises have accounted for a growing share of 2026 losses, from Trust Wallet's $7 million browser extension hack to the Coldcard hardware wallet thefts. DeFi recorded about 70 exploits and $746 million stolen in the second quarter, the most-hacked quarter on record.

[UPDATE: Article was updated Aug. 31 to include Rain statement]