TLDR
- A vulnerability in an outdated Rain card contract was exploited, draining roughly $1.1 million across multiple Solana-based programs
- Avici lost $500,800 affecting 1,685 users; Tria lost over $430,000 affecting 636 users
- The AVICI token dropped 49% from its 24-hour high, hitting a record low of $0.217
- Stolen stablecoins were swapped to SOL, bridged to Ethereum, and sent through Tornado Cash
- Both Avici and Tria have pledged to refund affected users; Avici has filed a report with the FBI
A vulnerability in an outdated smart contract has led to a $1.1 million hack across multiple Solana-based crypto card programs, with the bulk of losses falling on users of neobanks Avici and Tria.
⚠️ALERT: Crypto neobank Avici is being drained in an apparent ongoing attack.
More than $1 MILLION has left card collateral accounts on the Solana-based platform, per on-chain data, with the attacker's wallet funded through the deBridge cross-chain bridge.
Avici says it is… pic.twitter.com/n2pul5Bkrs
— Coin Bureau (@coinbureau) August 28, 2026
Rain, which provides the underlying stablecoin card infrastructure as a Visa principal member, said its monitoring systems detected the flaw in an outdated contract version. Rain upgraded all programs running that version and reported no further unauthorized activity.
The attacker exploited the vulnerability by repeatedly submitting a signed authorization, adding itself as an administrator to individual card-collateral accounts, and withdrawing their balances.
The stolen stablecoins were then swapped into Solana, bridged to Ethereum, and sent through crypto mixer Tornado Cash.
Avici Takes the Biggest Hit
Avici, a self-custodial neobank that lets users spend crypto via a Visa-integrated credit card, reported $500,800 in losses across 1,685 users.
The company said the attack was limited to a Solana contract that held funds after customers topped up their cards. Self-custodial wallets on Solana and Ethereum-compatible networks were not affected.
Avici pledged to refund every affected card balance. The company also filed a report with the FBI’s Internet Crime Complaint Center. No timeline or funding source for the refunds has been disclosed.
The AVICI token dropped 49% from a 24-hour high of $0.43 to a record low of $0.217 before recovering to around $0.378.
Tria Also Hit, Promises Full Repayment
Tria, another Rain-powered neobank, said 636 of its users were affected, with losses totaling more than $430,000.
Tria vowed to repay users in full. Its token also fell, dropping more than 10% at one point following the news.
Neither company has named the other programs impacted in the attack, and the total loss across all affected platforms has not been fully disclosed.
The gap between the $1.1 million traced onchain and Avici’s reported figure suggests other Rain-powered programs were hit as well.
Spending Context
The incident comes as crypto card usage is growing fast. Tracked crypto-card spending more than tripled to $1.04 billion in July, with stablecoins funding 70% of more than 10 million transactions.
The hack highlights a custody distinction that matters for users. Funds held in Avici’s self-custodial wallets were safe, but money loaded onto cards moved into a third-party contract, which is where the exploit occurred.
Avici’s terms identify Third National as the card issuer, with Rain providing the infrastructure layer beneath it.
