🚨 A $1.1M hack causes Avici’s crypto neobank token to plummet nearly 50% A vulnerability in an older version of the smart contract provided by Rain led to approximately $1.1M in crypto being drained from multiple programs on Solana, with Avici users alone suffering losses of about $500,800. The market reacted almost immediately. The token solana:BANKJmvhT8tiJRsBSS1n2HryMBPvT5Ze4HU95DUAmeta dropped from its 24-hour high of $0.43 to $0.217—marking its lowest level ever—a decline of nearly 49%—before recovering to around $0.378. 🔓 What happened? Avici is a self-custodial neobank that allows users to spend crypto via Visa cards. According to Avici, the attack targeted only a single Solana contract where funds were deposited after users loaded money onto their cards. Users’ self-custodial wallets on Solana and Ethereum-compatible chains were not affected. Avici stated that 1,685 users were impacted and pledged to fully reimburse all lost card balances. But Avici was not the only victim. Tria, another crypto neobank using Rain’s infrastructure, reported that 636 users were affected, with total losses exceeding $430,000. Tria also committed to full refunds for users, despite its token briefly dropping more than 10%. 🧩 What did the hacker do? On-chain data shows the attacker repeatedly submitted a signed authorization, then added themselves as an administrator to each card collateral account. This allowed the attacker to withdraw the full balance from each account. The stolen stablecoins were subsequently swapped for SOL, bridged to Ethereum, and finally laundered through Tornado Cash. Rain stated that its monitoring system detected the vulnerability in an older contract version still in use by Avici and several other programs. Rain then upgraded all programs running this contract version and reported no further unauthorized activity. ⚠️ The concern goes beyond the $1.1M Avici and Tria have disclosed their individual loss figures, but the on-chain trace of approximately $1.1M suggests other programs using Rain’s infrastructure may also have been affected. Neither Rain nor Avici has yet published a list of affected programs or the total losses per entity. The incident also highlights an intriguing flaw in the concept of “self-custody” for crypto cards. While users truly control their crypto in their own wallets, when funds are loaded onto a card for spending, those funds are transferred to a smart contract operated by a third party. In other words, self-custody does not necessarily mean all your funds remain under a single layer of control. 💳 This is becoming an increasingly critical issue. Crypto cards are growing rapidly. Just in July, the total transaction value of tracked crypto cards surpassed $1.04 billion—a more than threefold increase—with stablecoins accounting for about 70% of over 10 million transactions. Avici said it has filed a report on the incident with the FBI’s Internet Crime Complaint Center. It remains unclear when users will receive their reimbursements or how these funds will be financed. Once again, crypto cards reveal the industry’s familiar weakness: You can self-custody your assets—until the moment you need to use them in the real world.