A Solana-based Avici security exploit has exposed more than $1 million in user funds, after an attacker reportedly spent just $190 on gas before draining over $670,000. Meanwhile, the Avici team has now refunded the affected user in full and added 10% cashback after identifying and fixing the contract issue.
How Attacker Used $190 in Gas to Drain $670K
According to on-chain data, the attacker funded a new wallet with about $190 in USDC, mainly to cover transaction fees. After staying inactive for around three hours, the wallet began interacting with Avici’s Solana card contracts at 16:49 UTC.
The attacker then started draining individual user balances. The first major batch of about $576,000 was moved between 18:19 and 18:34 UTC.
Further withdrawals pushed the total amount drained above $670,000, while the attack continued across 8,857 transactions.
As the attacker kept accessing user accounts, the total platform losses eventually exceeded $1 million.
One Contract Flaw Exposed 1,100+ Accounts
The attacker did not break into Avici’s main treasury or steal an upgrade key. Instead, the exploit targeted individual card-balance contracts.
The issue involved an outdated signature and permission check in infrastructure provided by Rain, Avici’s card-issuing partner.
The attacker submitted a specially created signature bundle, called AddCollateralAdmin, which incorrectly gave them admin access to more than 1,100 user collateral accounts.
The attacker could then withdraw funds from those accounts one by one. On-chain data showed a median withdrawal of $24, while the largest withdrawal in the sample was $5,268.
Avici Refunds Users With 10% Cashback
Avici said it has updated the affected Solana contract and has not seen further related activity.
The team also confirmed that affected balances were restored in full, with an additional 10% cashback on the amount withdrawn.
“If your Solana card balance was withdrawn a few hours ago, we’ve restored the full amount and added 10% cashback on what was withdrawn.”
Avici said the exploit was limited to Solana card contracts holding balances added through its Top Up system. Regular Solana and EVM wallets, along with EVM card balances, onramps, offramps and swaps, were not affected.
While, Avici says it is continuing to monitor the updated contracts while users are being asked to check their restored balances.