Avici's Solana neobank hack drains $500,000 from card users overnight

Avici says 1,685 users lost $500,859.22 from Solana card balances after a vulnerable Rain card contract was exploited on August 28. The wider attacker cluster moved more than $1 million through USDC, ETH and Tornado Cash, which is why this is bigger than one refund promise.

Avici's selling point is simple: keep your crypto in a wallet, top up a card balance, and spend without making the whole thing feel like a DeFi science project. On August 28, that promise broke in the least abstract way possible. An attacker drained $500,859.22 from the Solana card balances of 1,685 users after exploiting a vulnerable version of a card contract supplied by Rain, Avici's card-issuing partner.

That's the confirmed customer hit. Avici said the affected users would be refunded in full, and a later company update said refunds had been processed with an extra 10% cashback on the withdrawn amount. Good. Users shouldn't have to eat a contract failure that sat between their wallet and a card product.

The market still reacted like it should. BeInCrypto reported that AVICI fell about 40% to around $0.24 after the withdrawal incident, while AMBCrypto put the drop near 37% after the company first acknowledged problems with card-balance withdrawals. A refund can repair a user's balance. It doesn't repair confidence quite so neatly.