Cryptorank Avici Users Lose $500,859 in Solana Card Exploit
Article Content
- •1,685 users lost $500,859 due to a contract vulnerability.
- •The exploit involved unauthorized transactions on a Solana smart contract.
- •Avici will fully refund affected users and has reported the incident to the FBI.
On August 28, Avici disclosed that a vulnerability in a Solana smart contract, identified by card issuer Rain, resulted in the theft of $500,859.22 from 1,685 users' card balances. The exploit targeted a separate contract holding user funds, leaving self-custodial wallets unaffected. The attacker executed 14,672 transactions, draining the contract before it was upgraded. Rain has engaged forensic experts and is cooperating with law enforcement. Avici has committed to refunding all affected users and has filed a report with the FBI's Internet Crime Complaint Center. The incident highlights ongoing security risks within the Solana ecosystem, particularly for on-chain payment products.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Avici in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…