Card Contract Exploit Hits Solana Neobank Avici — Wallets Untouched, Refunds Complete
An attacker exploited an outdated version of a Rain card contract and drained card balances of 1,685 Avici users totaling roughly $500,000. Self-custody wallets were untouched; refunds plus 10 percent cashback are complete.
What Happened
On August 28, an attacker exploited a vulnerability in an outdated version of a Solana card contract by infrastructure provider Rain — draining card balances of users of the Solana neobank Avici: per Avici, 1,685 affected users with a combined $500,859.22. The flaw sat in the contract’s authorization checks, not in compromised keys.
The most important distinction first: users’ self-custody wallets were not affected. Funds were stolen exclusively from the separate contracts holding topped-up card balances.
The Status: Refunded
The response followed within a day: per the parties, Rain upgraded the affected programs, the exploit is stopped, and Avici confirmed on August 29 that all affected card balances were fully refunded — plus 10 percent cashback. An FBI report has been filed, per Avici; a full technical postmortem is pending. On-chain observers put the total damage across several Rain-using programs higher than Avici’s share — the reliably confirmed numbers are Avici’s.
The Lesson: Where Self-Custody Ends
The case shows a boundary that on-chain neobank marketing often blurs: self-custody ends where the balance sits after the card top-up. The wallet belongs to the user — the topped-up card balance sits in a contract of the card provider, with its permissions and its update state. Rain is broadly deployed as card infrastructure — including behind Western Union’s Stablecard — which makes shared contract infrastructure its own risk class. Also clear: this was a flaw in an application contract — not a problem of the Solana protocol.
What protects at the wallet level and what doesn’t is covered in Solana Wallet Security.
Note: This is reporting, not investment advice. We deliberately omit exploit details that would ease replication.
What to Watch
- The announced technical postmortem from Rain and Avici
- Whether further programs ran the same contract version
- Whether card providers document balance contracts more transparently going forward
Sources
- Avici — Incident update on X · Refund confirmation
- The Defiant — Report on the incident
- SOLANA·HUB knowledge: Solana Wallet Security