Key Takeaways:
Over $1 million drained from Solana crypto card platform Avici on Aug. 28, sending AVICI down 49.4% to a record low of $0.2175.
The attacker's wallet, FVNFzq[…]QnCEj, held 10,005.03 SOL worth about $1.07 million at 18:58 UTC plus roughly $11,600 in USDC and USDT, according to Solana RPC data queried by The Defiant. The wallet was initially funded with 1.79 SOL bridged through deBridge at 13:40 UTC and made its first call against Avici's programs at 16:49:48 UTC.
Transaction logs show a repeating three-step pattern: the wallet called SubmitSignatures on Avici's authorization program, then AddCollateralAdmin on the collateral program to register an additional administrator, followed by WithdrawCollateralAsset to transfer collateral. In one reviewed transaction, a single withdrawal moved 2,346.77 USDT from a user's collateral account. The wallet signed 14,672 transactions, of which 2,344 failed, and its SOL holdings grew by about 2,595 tokens worth approximately $277,000 during an 11-minute period.
Avici acknowledged "an issue affecting card balance withdrawals" in an X post at 18:42 UTC, about one hour and 53 minutes after the first drain transaction, but has not confirmed the total loss, the number of affected users, or whether compensation will be provided. The incident raises questions about the platform's self-custody claims, as the reported ability to add administrators and withdraw collateral contradicts its advertised model.
Anonymous on-chain analyst STACC built a live tracker for the affected transfers, identifying 125 sending accounts with individual transfers ranging from approximately 9 USDC to more than 26,000 USDT. Neither Avici nor an independent security company has published a post-mortem identifying how the attacker obtained authorization.
Both Avici programs were upgradeable and shared the same upgrade authority, reportedly a standard Solana account rather than a multisignature account. No evidence has yet shown that the upgrade authority caused or enabled the withdrawals.
Operational controls have drawn increased attention as attacks move beyond smart contract flaws. In July, crypto.news reported security findings showing that compromised keys, signers and infrastructure accounted for 88.3% of roughly $764 million stolen during the second quarter of 2026. The Hacken report found that only 4% of tracked projects combined audits, active bug bounties, and third-party monitoring.
Avici describes its product as a self-custodial wallet connected to a secured Visa credit card. Its Apple App Store listing states that users remain in control and that Avici never holds their funds. Under the card model, customers deposit crypto into collateral accounts and receive a corresponding credit limit.
The reported ability to add another administrator and remove unspent collateral raises questions about how Avici's authorization controls enforce its advertised self-custody model. Avici's documentation identifies Rain as a partner involved in its card service. Rain supplies stablecoin payment infrastructure and works with licensed institutions to issue cards connected to Visa and Mastercard. Neither Avici nor Rain has said that Rain's or Visa's systems were compromised.
The incident follows a separate wallet-related event in July, when on-chain analysts identified suspicious outflows exceeding $9.7 million from wallets linked to stablecoin payment provider Triple-A across networks including Solana, Ethereum, TRON and TON.
AVICI dropped 49.4% over 24 hours to $0.2175 as reports of the withdrawals spread, according to CoinGecko data. The selloff reduced the token's market capitalization to approximately $2.84 million and pushed its price to a record low. Trading volume reached about $656,543 during the same 24-hour period, with most activity occurring through MetaDAO's futarchy automated market maker, while LBank, KCEX and MEXC accounted for the remaining reported activity.
CoinGecko lists AVICI's record high at $7.56, reached on Nov. 26, 2025. The incident-day low left the token approximately 97% below that peak.
Avici Inc. is a US company that lists a San Francisco address on its website, while its privacy policy identifies it as a Delaware corporation. The company raised $3.5 million through a capped MetaDAO token sale in October 2025, with 7,352 contributors committing approximately $34.23 million before Avici returned about 89.8% of the pledged USDC after applying the sale cap. The offering priced AVICI at $0.35 and valued the project at approximately $4.52 million on a fully diluted basis.
The attack on Avici's collateral programs does not implicate the Solana network itself, and no available report has identified a vulnerability in Solana's underlying blockchain. But the incident adds to a growing list of 2026 crypto losses tied to compromised keys and infrastructure rather than code flaws, and it challenges the security assumptions underpinning self-custodial payment products.
This article is for informational purposes only and does not constitute investment advice.
