Rain, a Solana-based debit card infrastructure, has been exploited due to a vulnerability in an outdated contract, with roughly $1.1 million in funds stolen. Affected crypto bank Avici saw its AVICI token plunge 49% from a 24-hour high of $0.43 to an all-time low of $0.217, before recovering to about $0.378. Avici said the attack only hit the card funding contracts used for loading spending balances; its self-custody wallets were not compromised, and it has promised to fully refund affected balances. According to on-chain data, 1,685 Avici users lost about $500,800, while 636 users of another crypto bank, Tria, lost more than $430,000. The gap between the roughly $1.1 million tracked on-chain and Avici's reported losses suggests other Rain-backed protocols were also attacked. Attackers repeatedly submitted signed authorizations to add themselves as admins of card collateral accounts and withdraw balances. The stolen stablecoins were swapped into SOL, bridged to Ethereum, and ultimately sent to the mixing service Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. The incident also highlighted custody handoff issues in some self-custody cards: users control their wallets, but spending funds are moved into third-party contracts.
Rain, a Solana-based debit card infrastructure, was exploited through a vulnerability in an outdated contract, with roughly $1.1 million in funds stolen. The attack hit crypto bank Avici, whose AVICI token slid from a 24-hour high of $0.43 to an all-time low of $0.217 — a 49% drop — before rebounding to around $0.378.
Only card funding contracts affected, Avici says
Avici confirmed that the attack affected only the card funding contracts used to load spending balances. Its self-custody wallets remain untouched, and the company says it will fully refund affected balances. On-chain data shows 1,685 Avici users lost about $500,800, while 636 users of another crypto bank, Tria, lost more than $430,000. The difference between the roughly $1.1 million tracked on-chain and the loss reported by Avici indicates that other Rain-backed protocols were also hit.
How the attacker drained funds
Transaction data reveals that the attacker repeatedly submitted signed authorizations, adding themselves as an admin of card collateral accounts and withdrawing balances. The stolen stablecoins were swapped into SOL, bridged to Ethereum, and eventually sent to the mixing service Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center.
Custody handoff concerns
The incident also exposed custody handoff issues behind some self-custody crypto cards: users hold their wallets, but spending funds are transferred into third-party contracts.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
