Hackers steal over $1 million from Solana-based bank Avici

ChainCatcher report: Solana’s new bank, Avici, has been under sustained attack, with attackers stealing over $1 million from users. The attacker’s wallet holds 10,005.03 SOL (approximately $1.07 million) and around $11,600 in USDC and USDT. The attack pattern involves first calling Avici’s authorization program’s SubmitSignatures, then invoking the collateral program’s AddCollateralAdmin, and finally executing WithdrawCollateralAsset to withdraw funds. Both of Avici’s programs are upgradable and share the same standard Solana account for upgrade permissions rather than a multisig. Avici only acknowledged the breach 1 hour and 53 minutes after the first theft, stating, “We are aware of the issue affecting card balance withdrawals and are directly collaborating with all relevant partners to resolve it.” Prior to this, users had already reported stolen balances on social media. An anonymous on-chain analyst, STACC, has built a real-time tracker identifying 125 distinct sender accounts, with transfers ranging from approximately $9 USDC to over $26,000 USDT. As a result, the AVICI token dropped 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million—a record low. Avici raised funds in October 2025 via MetaDAO, originally targeting a cap of $3.5 million but ultimately securing $34.2 million in commitments; the team refunded 89.8% of the committed USDC.