Solana crypto card hacked, Avici token plummets 49%

The Solana-based crypto debit card infrastructure Rain was hacked due to vulnerabilities in outdated contracts, resulting in approximately $1.1 million in funds being stolen. The affected crypto bank Avici's token AVICI dropped from a 24-hour high of $0.43 to a historical low of $0.217, a decline of 49%, before recovering to around $0.378.

Avici confirmed that the attack only affected the card funds contract used for recharge consumption, and its self-custody wallets were not impacted, promising to fully refund the affected balances. In this incident, 1,685 Avici users lost approximately $500,800; another crypto bank, Tria, also had 636 users affected, with losses exceeding $430,000. The discrepancy between the approximately $1.1 million tracked on-chain and the losses reported by Avici indicates that other protocols supported by Rain were also attacked.

Transaction data shows that the attacker repeatedly submitted signature authorizations, adding themselves as administrators of the card collateral account and withdrawing balances. The stolen stablecoins were exchanged for SOL, cross-chain to Ethereum, and ultimately flowed into the mixer Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. This incident also exposed issues with the custody transfer behind some self-custody crypto cards: although users control their wallets, the funds used for consumption are transferred to third-party contracts.