Attacker Drains Over $1M in User Funds from Solana Neobank Avici

Solana neobank Avici is under a sustained attack, with the attacker having stolen over $1 million from users. The attacker's wallet holds 10,005.03 SOL (approximately $1.07 million) along with roughly $11,600 in USDC and USDT. The attack pattern is as follows: first calling SubmitSignatures on Avici's authorization program, then calling AddCollateralAdmin on the collateral program, and finally executing WithdrawCollateralAsset to extract balances. Both of Avici's programs are upgradeable and share a common regular Solana account rather than a multisig upgrade authority. Avici confirmed the issue in a post 1 hour and 53 minutes after the first theft transaction, stating it was "aware of the issue affecting card balance withdrawals and is working directly with all relevant partners to resolve it." Users had previously reported stolen balances on social media. A real-time tracker built by anonymous on-chain analyst STACC counted 125 distinct sending accounts, with transferred amounts ranging from approximately 9 USDC to over 26,000 USDT. As a result, the AVICI token fell 49.4% over 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, ultimately receiving $34.2 million in commitments, and the team refunded 89.8% of the committed USDC.