Card Contract Exploit Hits Solana Neobank Avici — Wallets Untouched, Refunds Complete
An attacker exploited an outdated version of a Rain card contract and drained card balances of 1,685 Avici users totaling roughly $500,000. Self-custody wallets were untouched; refunds plus 10 percent cashback are complete.
What Happened
On August 28, an attacker exploited a vulnerability in an outdated version of a Solana card contract by infrastructure provider Rain — draining card balances of users of the Solana neobank Avici: per Avici, 1,685 affected users with a combined $500,859.22. The flaw sat in the contract’s authorization checks, not in compromised keys.
The most important distinction first: users’ self-custody wallets were not affected. Funds were stolen exclusively from the separate contracts holding topped-up card balances.
The Status: Refunded
The response followed within a day: per the parties, Rain upgraded the affected programs, the exploit is stopped, and Avici confirmed on August 29 that all affected card balances were fully refunded — plus 10 percent cashback. An FBI report has been filed, per Avici; a full technical postmortem is pending. On-chain observers put the total damage across several Rain-using programs higher than Avici’s share — the reliably confirmed numbers are Avici’s.
The Lesson: Where Self-Custody Ends
The case shows a boundary that on-chain neobank marketing often blurs: self-custody ends where the balance sits after the card top-up. The wallet belongs to the user — the topped-up card balance sits in a contract of the card provider, with its permissions and its update state. Rain is broadly deployed as card infrastructure — including behind Western Union’s Stablecard — which makes shared contract infrastructure its own risk class. Also clear: this was a flaw in an application contract — not a problem of the Solana protocol.
What protects at the wallet level and what doesn’t is covered in Solana Wallet Security.
We deliberately omit exploit details that would ease replication.
What to Watch
- The announced technical postmortem from Rain and Avici
- Whether further programs ran the same contract version
- Whether card providers document balance contracts more transparently going forward
Sources
- Avici — Incident update on X · Refund confirmation
- The Defiant — Report on the incident
- SOLANA·HUB knowledge: Solana Wallet Security