Avici, a new bank on Solana, is facing an ongoing attack that has already drained more than $1 million from users, according to ChainCatcher. On-chain data cited in the report shows the attacker wallet holds 10,005.03 SOL, worth about $1.07 million, along with roughly $11,600 in USDC and USDT. The attack flow involved three calls: SubmitSignatures in Avici’s authorization program, AddCollateralAdmin in its collateral program, and WithdrawCollateralAsset to pull out balances. Both Avici programs were reportedly upgradeable and shared the same standard Solana account for upgrade authority instead of a multisig. Avici acknowledged the issue 1 hour and 53 minutes after the first theft transaction, saying it was aware of a problem affecting card balance withdrawals and was working directly with all relevant partners. Before that statement, users had already reported stolen balances on social media. A real-time tracker created by anonymous on-chain analyst STACC counted 125 distinct sending accounts, with transfers ranging from about 9 USDC to more than 26,000 USDT. AVICI fell 49.4% over 24 hours to $0.2175, pushing its market capitalization to about $2.84 million and marking a record low.
Avici, a new bank built on Solana, is still under attack, and users have already lost more than $1 million, according to ChainCatcher.
Figures cited in the report say the attacker’s wallet contains 10,005.03 SOL, valued at roughly $1.07 million, along with about $11,600 in USDC and USDT.
The attack followed a three-step pattern. First, it called SubmitSignatures in Avici’s authorization program. Then it triggered AddCollateralAdmin in the collateral program. After that, it used WithdrawCollateralAsset to pull out balances.
Both Avici programs were upgradeable. And both used the same standard Solana account as the upgrade authority, not a multisig account.
Avici acknowledged the incident 1 hour and 53 minutes after the first theft transaction. The project said it was “Aware of the issue affecting card balance withdrawals and working directly with all relevant partners to resolve it” (“We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it.”). Before that statement came out, users were already posting on social media that their balances had been stolen.
A live tracker put together by anonymous on-chain analyst STACC logged 125 different sending accounts. The incoming transfers ranged from around 9 USDC to more than 26,000 USDT.
AVICI fell 49.4% in the past 24 hours to $0.2175. Its market capitalization was about $2.84 million, the lowest level on record.
The report also said Avici raised money through MetaDAO in October 2025. The initial cap was $3.5 million, but total commitments climbed to $34.2 million. The team gave back 89.8% of the committed USDC.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
