The attacker behind the Rain card contract exploit has cross-chain transferred approximately $1.1 million in stolen funds to Ethereum and washed them through the Tornado Cash mixer. Blockchain security firm Blockaid tracked the incident, which affected multiple crypto neobanks including Avici and Tria, impacting over 2,300 users. Rain has upgraded all vulnerable contract versions but has not yet released a full technical report explaining why some programs still used outdated contracts.
According to crypto.news, the attacker who exploited Rain's card contract has moved approximately $1.1 million in stolen funds cross-chain to Ethereum and laundered them through the Tornado Cash mixer. Blockchain security firm Blockaid tracked the attack, which impacted several crypto neobanks including Avici and Tria, affecting over 2,300 users.
Rain stated that it has upgraded all programs using the vulnerable contract versions. Blockaid discovered that the attacker exploited authorization flaws in outdated contracts, specifically targeting the collateral contracts that hold user card balances, rather than user self-custodial wallets. Rain has not yet published a full technical report explaining why some programs were still using the older contract versions.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
