Avici, a crypto neobank built on Solana, was exploited after an attacker drained its card collateral vault. CoinDesk reported on Aug. 29 that the AVICI token fell about 49% from its 24-hour high after the incident.
Three contract calls opened the way to the withdrawal
Avici’s documentation had said that only a user’s own wallet could move the card collateral funds. The report said the attacker got around that protection in three steps.
First, the attacker called SubmitSignatures on Avici’s authorization program. Next came AddCollateralAdmin on the collateral program. The last step was WithdrawCollateralAsset, which was used to pull the funds out.
Estimates of the loss differ, ranging from roughly $650,000 to more than $1.1 million.
Avici says 1,685 users will be made whole
In a post on its official X account, Avici confirmed an issue "affecting card balance withdrawals."
In a later explanation, the company said the root cause was a flaw in an "outdated Solana card contract" provided by issuing partner Rain. Avici added that the same contract had also been used by a small number of other programs and has since been fully upgraded.
The company said it will fully reimburse 1,685 affected users.
Token selloff puts focus on the limits of non-custodial claims
The AVICI token lost nearly half its value in a single day after the news broke. The episode drew attention not only because of the amount removed from the vault, but also because it challenged a familiar promise used by many crypto startups: that a product is non-custodial and only the user can move the funds.
As described in the report, if management permissions across authorization and collateral programs can be chained together through external calls and used to bypass the original safeguards, that promise does not hold up on its own. For users, the incident is another reminder that code and permission design matter as much as product messaging before funds are deposited into crypto financial products built around yield or convenience.