Avici Users Lose $500,859 in Solana Card Exploit

On August 28, Avici disclosed that a vulnerability in a Solana smart contract, identified by card issuer Rain, resulted in the theft of $500,859.22 from 1,685 users' card balances. The exploit targeted a separate contract holding user funds, leaving self-custodial wallets unaffected. The attacker executed 14,672 transactions, draining the contract before it was upgraded. Rain has engaged forensic experts and is cooperating with law enforcement. Avici has committed to refunding all affected users and has filed a report with the FBI's Internet Crime Complaint Center. The incident highlights ongoing security risks within the Solana ecosystem, particularly for on-chain payment products.

Key Points: • 1,685 users lost $500,859 due to a contract vulnerability. • The exploit involved unauthorized transactions on a Solana smart contract. • Avici will fully refund affected users and has reported the incident to the FBI.