A $1.1 Million Crypto Card Hack Crashed a Neobank’s Token 49%

An attacker drained more than $1 million from card balances at Avici, a Solana neobank that issues Visa cards backed by customers’ own crypto. The AVICI token fell 49% to a record low Friday.

The company pegged the loss at $500,859.22 pulled from 1,685 users, all of whom it says will be refunded in full. On-chain data tells a bigger story. A single attacker wallet moved exactly 10,000 SOL, roughly $1.07 million at the time, out of card collateral accounts before going empty, according to the Defiant.

The flaw did not live in Avici’s own code. It sat in a contract belonging to Rain, the card issuer behind Avici’s Visa product and the card processor for Western Union’s Stablecard, which launched Aug. 4. Rain said its monitoring found “a vulnerability impacting a small number of programs using an outdated version of our Solana contracts” and that every program running that version has been upgraded.

In practice, that means anyone whose card was topped up through the old Rain contract was exposed. The neobank fronting the card made no difference.

The attacker wallet received 1.79 SOL bridged through deBridge at 13:40 UTC. It sat idle for three hours. The first call against the card contracts came at 16:49:48 UTC. What followed was relentless: 14,672 transactions signed, 2,344 of them failed, before the wallet shipped 10,000 SOL out at 19:02:45 UTC while the drain was still running. By 19:26:34, it was empty.

The pattern was mechanical. Per transaction logs, the wallet called SubmitSignatures on Rain’s authorization program, invoking Solana’s Ed25519 signature-verification precompile. Then AddCollateralAdmin on the collateral program to register itself as administrator on a user’s account. Then WithdrawCollateralAsset to pull the balance. One reviewed call moved 2,346.77 USDT out of a single user’s collateral account. The wallet swapped stablecoins into SOL as it went.

Both Rain programs are upgradeable. Both share the same upgrade authority. That authority is a plain Solana account, not a multisig.

Avici’s first public statement landed at 18:42 UTC. Nearly two hours after the first drain transaction. “We are aware of an issue affecting card balance withdrawals,” the company wrote on X. Users had already been posting about missing balances.

Rain said at 20:26 UTC it has “engaged third-party forensics experts to investigate, and will work with law enforcement and relevant regulatory authorities. All affected users will be made whole.” Avici filed a report with the FBI’s Internet Crime Complaint Center. “We are deeply sorry for the concern and inconvenience this has caused,” Avici wrote.

The neobank’s self-custodial wallets were untouched. Only the separate contract that holds the balances users top their cards up with was drained.

The 10,000 SOL landed at address MsaXH6cGDahPQDwJjFYod7RW8QLVDZGByywWvwQ9TFu. Thirty-three seconds later it split into 6,999.98 SOL and 2,999.99 SOL. Those two downstream addresses now hold 82,910 SOL and 110,472 SOL, sign thousands of transactions an hour, and carry long memecoin balance lists. The profile is consistent with an exchange or market-maker hot wallet. That is not confirmed.

AVICI changed hands at $0.2175, down 49.4% over 24 hours. Market cap sat at $2.84 million on $656,543 of volume, per CoinGecko. The token set a record low Friday. Its prior all-time high was $7.56 on Nov. 26, 2025. Most of the volume, about 58%, runs through MetaDAO’s futarchy AMM. The rest splits across LBank, KCEX, and MEXC. Avici raised $3.5 million through MetaDAO in October 2025 against $34.2 million in committed USDC, refunding 89.8% of it, at an initial price of $0.35. The token now trades roughly 38% below that ICO price.

Avici is registered as Avici Inc. in San Francisco. It does not name its team on its website. On Aug. 24 it said it would be among the first neobanks to offer Coinbase’s tokenized stocks on Base.

What remains unknown: how long the outdated Rain contract had been deployed, why programs running it were not upgraded sooner, and how the attacker found the vulnerable contract. Rain settles card transactions with Visa in stablecoins and issues cards for Western Union’s Stablecard. That broadens the universe of accounts that touched the faulty code well beyond Avici’s own user base.