Solana-based neobank Avici confirmed on August 29, 2026 that it will fully reimburse 1,685 users hit by a security breach tied to an outdated card smart contract, with credits processed automatically over the coming weeks. Avici’s own figures put the confirmed card-balance loss at $500,859.22, while the broader on-chain laundering trail traced by researchers pushed the total closer to $1 million to $1.1 million, according to CoinDesk and CryptoRank. The breach hit August 28 and triggered a swift compensation pledge, a crash in the AVICI token, and a copycat exploit against an unrelated Ethereum lending protocol less than 24 hours later.
The incident lands at a sensitive moment for crypto-native banking products, which have spent 2026 trying to convince mainstream users that card-linked custody can be as safe as a traditional bank account. Avici’s fast, no-claims-process refund pledge is being read across the industry as a test case for how neobanks handle smart contract failures, and whether goodwill compensation can substitute for the deposit insurance traditional banks carry by law.
What Happened: Inside Avici’s $500,859 Card Breach
Avici bills itself as a Solana-based crypto neobank, offering users a card product backed by collateral held in a dedicated smart contract rather than a conventional custodial ledger. According to a report from CryptoBriefing, the breach exploited a vulnerability inside an outdated Solana card contract linked to Avici’s card-issuing partner, Rain. The flaw let an attacker manipulate the contract’s authorization logic and pull funds directly from the standalone contract that held card balances.
Avici said the damage was contained to that single contract. Cryptopolitan reported that the company explicitly confirmed users’ self-custodied Solana and EVM wallets were not touched, meaning the exposure was limited to funds parked specifically for card spending rather than a user’s full crypto holdings. That distinction mattered for how Avici scoped its response: rather than a platform-wide freeze, the company treated this as a contained infrastructure failure in one product line, a narrower incident than the kind of network-wide compromise seen in the TheHatman Azure Entra breach affecting 3.6 million records earlier this year.
The confirmed loss figure, $500,859.22, came from Avici’s own reconciliation of affected card balances across 1,685 accounts. That number has stayed consistent across CryptoBriefing, BingX flash news, and CryptoRank’s coverage, giving it more credibility than the wider range of “up to $1 million-plus” figures used by outlets tracking the attacker’s on-chain movements after the theft.
Timeline: From the August 28 Exploit to Public Disclosure
The exploit itself took place on August 28, 2026. Avici moved quickly, posting acknowledgment of the incident and its refund commitment on X the same day, according to Cryptopolitan. Fuller public disclosure, including the confirmed dollar loss and the 1,685-user figure, followed on August 29. By August 30, multiple outlets, including CryptoRank, Cryptopolitan, and Bitcoin World, had confirmed the reimbursement plan and were tracking the laundering path of the stolen funds.
That sequence, roughly 24 to 48 hours from exploit to a firm compensation commitment, is fast by the standards of crypto incident response. It also compressed public scrutiny into a narrow window: reporters, on-chain analysts, and Avici itself were all racing to characterize the same event before all the facts were settled, which explains why early loss estimates ranged from $500,000 to over $1.1 million depending on the outlet and the moment it published.
How the Exploit Worked: A Flaw in an Outdated Card Contract
The root cause, per multiple reports tracing the on-chain activity, was an outdated version of the Solana smart contract Rain uses to manage collateral for card products. Rather than a stolen private key or a phishing campaign against users, this was a logic flaw baked into the contract’s own function permissions, the kind of vulnerability that security researchers call a privilege escalation bug.
The Vulnerable Call Sequence
On-chain reconstructions of the attack describe a specific chain of contract calls the attacker used to bypass normal withdrawal permissions. In simplified form, the sequence looked like this:
1. SubmitSignatures -> attacker supplies crafted signature data
2. AddCollateralAdmin -> attacker escalates to an admin role on the collateral vault
3. WithdrawCollateralAsset -> attacker drains card-balance collateral to their own walletThat sequence let the attacker register themselves as an administrator on the collateral vault before executing a withdrawal that should have required legitimate user or issuer authorization. Because the flaw lived in contract logic rather than in any individual user’s keys, no amount of user-side caution, such as avoiding phishing links or securing a seed phrase, would have prevented it. This is a structural failure in Avici’s dependency on Rain’s card infrastructure, not a user-error breach.
Following the Money: SOL, USDC, ETH and Tornado Cash
On-chain analysts tracked the attacker’s wallet holding roughly 10,005 SOL, worth approximately $1.07 million at the time, alongside about $11,600 in USDC and USDT. That SOL position is the main reason the widely cited “$1 million-plus” headline figure diverges from Avici’s confirmed $500,859.22 in card-balance losses: the attacker appears to have combined proceeds from the Avici exploit with other funds before starting to launder them.
The Laundering Path in Numbers
According to on-chain tracing cited in the aftermath coverage, the attacker converted roughly 10,000 SOL into USDC and bridged 1,113,843.49 USDC through four separate deBridge orders. That bridge produced approximately 456 ETH on the receiving end. The attacker then deposited 455.9 ETH into Tornado Cash across 23 separate transactions, a mixing service used to obscure the origin of crypto funds. Some outlets rounded the bridged ETH figure to approximately 418 ETH, which explains the minor discrepancies between reports describing the same laundering run.
The use of Tornado Cash is notable given the mixer’s long history of sanctions scrutiny in the United States. Its reappearance in a fresh crypto exploit underscores how thin the effective deterrent against these tools remains for attackers operating outside U.S. jurisdiction, even years after the U.S. Treasury first moved against Tornado Cash addresses.
Avici’s Reimbursement Plan for 1,685 Users
Avici’s public commitment, repeated consistently across CryptoBriefing, Cryptopolitan, and Bitcoin World, is straightforward: every one of the 1,685 affected users will have their card balance refunded in full, with no claims process required. Credits are set to be processed automatically over the coming weeks rather than requiring users to file individual support tickets or provide loss documentation.
That approach mirrors how several crypto platforms have handled exploits in 2025 and 2026: absorb the loss directly rather than wait for insurance or a white-hat negotiation with the attacker, since the stolen funds were already moving through Tornado Cash and were unlikely to be recovered. For Avici, a still-growing neobank, covering roughly half a million dollars in confirmed losses is a meaningful but survivable cost, assuming no further incidents compound it in the near term.
The refund pledge also does double duty as reputation management. A neobank’s entire pitch rests on trust that a debit-card-like product backed by crypto collateral is as safe as a bank account. Fumbling the response to a $500,000 exploit, even one caused by a third-party contract, would have been far costlier than the refund itself in terms of user churn.
AVICI Token Crashes as Confidence Wavers
Markets reacted immediately. CoinDesk reported the AVICI token fell as much as 49% intraday around the time the exploit became public, in a piece describing the incident as a “$1.1 million crypto card hack” that crashed the token. Other outlets captured different snapshots of the same slide: Altcoinbuzz cited a 27% drop, a report from Yahoo Finance cited a 40% crash, and separate token-tracker data cited in later coverage showed roughly a 5% decline over 24 hours but a steeper 30.10% decline over the following seven days.
The spread between these figures is a reminder that thinly traded tokens tied to a single product’s security reputation can swing wildly depending on the exact minute a price is sampled. What is consistent across every outlet is direction: AVICI dropped sharply and stayed down through the week, rather than snapping back once the refund pledge was announced.
Ajna Copycat Exploit Hits Ethereum Lending a Day Later
Roughly 24 hours after the Avici incident, Ajna, an oracle-free lending protocol on Ethereum, disclosed its own exploit. CryptoRank and Cryptopolitan both described the two incidents as part of the “same run” of attacks, though the technical methods differed. Where Avici’s flaw was a withdrawal-authorization bug in a Rust-based card contract, Ajna’s exploit relied on liquidation accounting manipulation, abusing the internal logic Ajna uses to avoid depending on external price oracles.
Ajna’s losses totaled approximately $775,000 across seven pools, with the largest single hit landing on its syrupUSDC pool at roughly $173,700, followed by wstETH at about $159,800 and rETH at around $143,000 across two transactions. Ajna’s team responded by publicly instructing users to withdraw all quote tokens, repay outstanding loans, and stop all new interactions with the protocol while it investigated.
The back-to-back timing, even without identical exploit code, suggests attackers are actively probing DeFi and crypto-banking infrastructure for similar classes of authorization and accounting bugs, and moving fast once one target is confirmed vulnerable. That pattern echoes what this site covered when a separate Coldcard hardware wallet entropy flaw drained roughly $103 million from about 7,300 Bitcoin wallets, another case where a single infrastructure-level bug scaled into a widespread loss event once discovered.
Rain’s Role and the Security Response
Rain, the card-issuing partner behind Avici’s product, is central to how this incident resolves. Coverage from CryptoBriefing indicates Rain identified the vulnerable contract and pushed an upgrade to close the flaw shortly after the exploit was confirmed. Reports also indicate a third-party forensic firm was brought in to investigate the full scope of the breach and confirm no other Rain-integrated products carried the same flaw.
This is a reminder that neobanks built on crypto rails are only as secure as their weakest infrastructure partner. Avici’s own front-end and custody design for user wallets held up, based on the confirmed scope of the breach, but the card issuance layer it outsourced to Rain became the point of failure. That dependency structure, common across crypto-card products that don’t build issuance in-house, means a single vendor’s patch cadence can expose every neobank building on top of it at once.
FBI IC3 Report and the Regulatory Vacuum for Neobanks
Avici said it filed a report with the FBI’s Internet Crime Complaint Center (IC3), the standard first step for U.S.-facing companies reporting cyber-enabled theft. That filing puts the incident on federal law enforcement’s radar, though recovery of funds routed through Tornado Cash is historically rare once a mixer transaction confirms.
The episode also highlights a regulatory gap that has followed crypto neobanks since the category emerged: unlike a chartered bank, Avici’s card balances are not backed by FDIC insurance or an equivalent government guarantee. The entire recovery for affected users depends on Avici voluntarily absorbing the loss rather than any legal requirement to do so. That is a meaningful distinction for anyone comparing a crypto-native card product to a traditional debit card, and it is likely to resurface as lawmakers and regulators continue scrutinizing how crypto-adjacent financial products should be classified, much as they have with the disclosure standards debated after incidents like the Abbott vishing breach earlier this year.
Avici Breach by the Numbers
The table below consolidates the confirmed figures from this incident, drawing on Avici’s own disclosures and the outlets that tracked the attacker’s on-chain movements.
| Metric | Figure | Source |
|---|---|---|
| Users affected | 1,685 | Avici, via CryptoBriefing |
| Confirmed card-balance loss | $500,859.22 | Avici, via CryptoBriefing |
| Broader on-chain laundering total | ~$1.02M–$1.1M | CoinDesk, CryptoRank |
| Exploit date | August 28, 2026 | Cryptopolitan |
| Public disclosure date | August 29, 2026 | Cryptopolitan, CryptoRank |
| SOL converted by attacker | ~10,000 SOL | On-chain tracing reports |
| USDC bridged via deBridge | 1,113,843.49 USDC (4 orders) | On-chain tracing reports |
| ETH deposited into Tornado Cash | 455.9 ETH (23 transactions) | On-chain tracing reports |
| AVICI token intraday drop (peak estimate) | Up to 49% | CoinDesk |
| AVICI token 7-day decline | ~30.10% | Token-tracker data |
How Avici Compares to Other 2026 Crypto Security Incidents
Avici’s breach is small next to the largest crypto exploits of the past year, but the pattern it fits, an infrastructure-level bug rather than a stolen private key, is the more common failure mode across 2026’s incidents. The table below places it alongside two other cases: the Ajna exploit that hit within a day, and the unrelated Coldcard hardware wallet flaw covered separately, which shows how differently these incidents can scale depending on where the vulnerability sits in the stack.
| Incident | Root Cause | Confirmed Loss | Users/Wallets Affected |
|---|---|---|---|
| Avici (Solana neobank) | Outdated card contract, withdrawal-authorization flaw | $500,859.22 (card balances) | 1,685 users |
| Ajna (Ethereum lending) | Liquidation accounting manipulation | ~$775,000 | Seven affected pools |
| Coldcard (hardware wallet) | Entropy/RNG generation flaw | ~$103 million | ~7,300 wallets |
The gap between Avici’s roughly half-million-dollar loss and Coldcard’s nine-figure exposure illustrates why the location of a bug matters as much as its existence. A flaw in a single neobank’s card contract caps the blast radius at that platform’s users. A flaw in a widely deployed hardware wallet’s random number generation can compromise anyone who ever generated a key on that device, regardless of which service they used it with. Readers weighing custody options should also compare how established breaches like the McKesson data breach affecting 284 million records or the Hasbro employee data breach handled disclosure and remediation timelines against Avici’s roughly 24-hour turnaround from exploit to public compensation pledge.
Why Crypto Card Infrastructure Keeps Failing
Crypto-linked card products sit at an uncomfortable seam between two very different security cultures. Traditional card networks like Visa and Mastercard rely on decades of fraud-detection tooling, chargeback frameworks, and regulatory oversight. Crypto-native issuers like Rain instead rely on smart contracts to hold and release collateral, which means every line of that contract’s code is a potential attack surface, and every upgrade cycle carries the risk of leaving an old, vulnerable version reachable somewhere in the stack.
The Avici incident specifically involved an outdated contract, which points to a deployment and patch-management failure as much as a design flaw. Keeping every integration partner synced to the latest, audited version of shared infrastructure is an operational challenge that scales poorly as more neobanks plug into the same card-issuance rails. The Ajna exploit hitting a completely different codebase within 24 hours reinforces that attackers are running broad scans across DeFi and crypto-banking infrastructure rather than targeting one company in isolation.
This is also a governance question. Security audits of smart contracts are typically a one-time or periodic event, not continuous monitoring. A contract that passed an audit at launch can become the outdated, vulnerable version months later if the issuer doesn’t proactively deprecate it once a patched version ships. Avici’s exposure appears to trace directly to that gap.
Market Impact: What This Means for Crypto Neobanking
For the broader crypto neobanking category, the Avici episode is a mixed signal. On one hand, a fast, full, no-claims-process refund is close to the best-case outcome for an exploit of this kind, and it demonstrates that at least some crypto-native financial products can absorb a five-to-six-figure loss without collapsing or freezing withdrawals. On the other hand, the fact that the underlying flaw sat in a widely used card-issuance partner’s contract, not something unique to Avici, means other neobanks built on similar rails have reason to audit their own integrations immediately.
Investors in AVICI and comparable neobank tokens are likely to price in a higher risk premium for platforms whose card products depend on third-party smart contracts rather than in-house issuance. That’s consistent with the sharper and more sustained decline in AVICI’s price over the week following disclosure, compared with any single-day snapshot: markets appear to be repricing counterparty and infrastructure risk, not just reacting to a headline.
Predictions: What Happens Next
- Rain is likely to face pressure from every neobank client it services to prove no other legacy contract versions remain exposed, potentially triggering a broader audit wave across its integration partners.
- Expect other crypto-card issuers to publish proactive security statements in the coming weeks, distancing themselves from Rain’s contract architecture or confirming they use different infrastructure entirely.
- Avici’s refund timeline, described as “coming weeks,” will likely become a trust benchmark. Any delay beyond that window would do more reputational damage than the original breach.
- Regulatory attention to crypto neobank card products is likely to increase, particularly around disclosure requirements and whether these products should carry deposit-insurance-equivalent protections.
- Further copycat exploits targeting similar authorization-logic bugs in DeFi and crypto-banking contracts are likely in the near term, given how quickly Ajna’s exploit followed Avici’s.
None of these are guaranteed outcomes, but they follow directly from how this specific incident unfolded: a shared-infrastructure bug, a fast refund pledge, and an immediate copycat exploit against unrelated infrastructure all point toward more scrutiny of the card-issuance layer across the crypto-banking sector.
Frequently Asked Questions
What is Avici?
Avici is a Solana-based crypto neobank that offers users a card product backed by collateral held in a dedicated smart contract, rather than a conventional custodial account.
How much money was stolen from Avici?
Avici confirmed $500,859.22 in card-balance losses across 1,685 users. Separate on-chain tracing of the attacker’s laundering activity put the broader total closer to $1 million to $1.1 million, according to CoinDesk and CryptoRank.
Will affected users get their money back?
Yes. Avici pledged to refund every affected user’s card balance in full, with credits processed automatically over the coming weeks and no claims process required.
What caused the Avici breach?
An outdated Solana smart contract used by Avici’s card-issuing partner, Rain, contained a flaw in its withdrawal-authorization logic, letting an attacker escalate privileges and drain collateral from the contract that held card balances.
Were self-custodied crypto wallets affected?
No. Avici said the breach was contained to the standalone smart contract holding card balances, and that users’ self-custodied Solana and EVM wallets were not affected.
Is the Ajna exploit related to the Avici hack?
Reports describe both exploits as part of the same broader run of attacks against crypto and DeFi infrastructure, occurring roughly 24 hours apart, though the technical methods differed: Avici’s was a contract authorization bug, while Ajna’s involved liquidation accounting manipulation.
Did Avici report the breach to law enforcement?
Yes. Avici said it filed a report with the FBI’s Internet Crime Complaint Center (IC3).
What happened to the stolen funds?
On-chain analysts traced the attacker converting roughly 10,000 SOL into USDC, bridging over 1.1 million USDC through deBridge, and depositing 455.9 ETH into Tornado Cash across 23 transactions to obscure the funds’ origin.
