Avici Discloses Solana Card Contract Vulnerability Affecting 1685 Users

Solana-based card program Avici disclosed on August 28 that a vulnerability in a Solana smart contract holding card balances, identified by card issuer Rain, affected 1,685 users and $500,859.22 before the contract was upgraded across programs. Avici said self-custodial wallets were not touched, will refund all impacted balances and filed a report with the FBI IC3, but the incident underscores recurring Solana security risks for on-chain card and payments products and raises DeFi and adoption trust concerns.

See what traders are focused on

Solana-based card program Avici has disclosed that its card-issuing partner Rain identified a vulnerability in a version of a Solana card contract used to hold user card balances, an incident the project described in an August 28 announcement . The affected contract has since been upgraded across all programs, and Avici said no further unauthorized activity has been observed after the fix.

According to Avici, the incident was confined to a single smart contract rather than user wallets. When a user tops up a card, funds move into a separate Solana contract that holds the card balance, and only this contract was affected. Avici’s self-custodial wallets, which hold funds on both Solana and EVM chains, were not touched and remain under users’ control, the company said. The separation between card balances and self-custodial wallets kept the damage from spreading further, according to the project.

Avici’s reconciliation shows 1,685 users were affected, representing $500,859.22 in card balances. The company noted the vulnerable contract version was also used by a small number of other programs, though it did not identify those programs or disclose whether they suffered losses. Avici did not specify how the vulnerability was exploited or how long it may have been present before Rain discovered it.

Avici said every affected user will have their card balance refunded in full, and that it has filed a report with the FBI’s Internet Crime Complaint Center, the U.S. clearinghouse for cybercrime complaints. The company said it remains in close with its card-issuing and security partners and is monitoring the remediation closely, though it did not provide a timeline for completing the refunds.

The disclosure is the latest in a string of security incidents across the Solana ecosystem. Avici, which earlier launched virtual IBAN accounts on Solana , is among several card and payments projects building on the network. The episode follows broader warnings Solana-adjacent infrastructure, including a Rust supply-chain attack that researchers said put Solana-adjacent build pipelines at risk. As card products increasingly hold funds in on-chain contracts, the incident underscores the security burden that falls on the issuers managing those contracts.