Card issuer Rain says an attacker used an outdated version of its Solana contract, which a small number of programs were running. Both companies say affected users will be made whole.