$1.1 Million Solana Card Hack Crashes Neobank AVICI Token 49%

Exploit drains $1.1M from Solana card contracts

A security flaw in an outdated smart contract on the Solana blockchain allowed hackers to steal roughly $1.1 million from crypto card programs. The attack hit two neobanks, Avici and Tria, causing the value of Avici's token to drop by 49%.

Avici is a self-custodial neobank that lets users spend cryptocurrency using a Visa-integrated credit card. After the hack, its AVICI token fell from a 24-hour high of $0.43 to a record low of $0.217 before recovering slightly to around $0.305.

Key numbers from the breach

• Total stolen: Approximately $1.1 million across several programs.
• Avici losses: $500,800 taken from 1,685 users.
• Tria losses: More than $430,000 taken from 636 users.
• Token impact: AVICI dropped 49%; Tria's token fell more than 10%.

What officials say about the cause

Rain, the company that provides the underlying stablecoin card infrastructure for both neobanks, identified the problem. A smart contract is a set of rules on a blockchain that automatically executes transactions. Rain stated that an outdated version of its card contract was the source of the vulnerability.

The company upgraded every program running that specific version and reported that no further unauthorized activity has been detected. Avici confirmed the attack was limited to the contracts holding funds after customers topped up their cards. Their self-custodial wallets, which store the actual crypto assets on Solana and Ethereum-compatible networks, were not affected.

How the stolen funds moved

Transaction data shows the attacker repeatedly submitted signed authorizations to gain access. They added themselves as administrators to individual card-collateral accounts and then withdrew the balances.

Once the attackers collected the stolen stablecoins—digital currencies pegged to the value of the US dollar—they swapped them for Solana (SOL). They then bridged the funds to the Ethereum network and sent them through Tornado Cash, a service used to mix cryptocurrencies and obscure the trail of transactions.

Refunds and investigation status

Both Avici and Tria have promised to repay all affected users in full. However, neither company has disclosed when the refunds will be distributed or how they will be funded. Avici has filed a report with the Federal Bureau of Investigation’s Internet Crime Complaint Center.

There is a discrepancy between the $1.1 million tracked on-chain and Avici's reported loss, indicating that other Rain-powered programs were also hit. Neither company has identified these additional programs or the specific amounts lost by each.

Why this matters for crypto cards

The incident highlights a key risk in the growing crypto card market: the custody handoff. While users control the money in their personal wallets, funds loaded onto a card move into a third-party contract for spending. As crypto card spending more than tripled to $1.04 billion in July, with stablecoins funding 70% of over 10 million transactions, the security of these intermediary contracts is critical.

Sources

• CoinDesk