Solana Crypto Card Hacked, Avici Token Plunges 49%

Solana-based crypto debit card infrastructure Rain was hacked due to a vulnerability in outdated contracts, with approximately $1.1 million in funds stolen. Affected crypto bank Avici's token AVICI fell from a 24-hour high of $0.43 to an all-time low of $0.217, a drop of 49%, before recovering to around $0.378. Avici confirmed the attack only impacted the card funding contract used for recharging and spending, while its self-custody wallets remained unaffected, and pledged to fully refund affected balances. In this incident, 1,685 Avici users lost approximately $500,800; another crypto bank, Tria, also saw 636 users affected, with losses exceeding $430,000. The discrepancy between the roughly $1.1 million tracked on-chain and Avici's reported losses indicates that other protocols powered by Rain were also attacked. Trading data shows the attacker repeatedly submitted signed authorizations to add themselves as administrators of card collateral accounts and withdraw balances, with stolen stablecoins swapped for SOL, bridged to Ethereum, and ultimately funneled into the mixer Tornado Cash. Avici has filed a report with the FBI's Internet Crime Complaint Center. The incident also exposed custody handoff issues behind some self-custody crypto cards: while users control their wallets, funds for spending are transferred into third-party contracts.