Tria and Avici Report 2,321 Users Hit by Rain Solana Card…

Crypto finance platform Tria has reimbursed 636 users who lost a combined $431,945 from card balances after a vulnerability in the Solana infrastructure operated by card issuer Rain allowed unauthorized withdrawals. Tria said each affected customer received a full refund plus an extra 10%, which works out to roughly $43,200 in additional compensation and total payments of about $475,000.

The incident began on Aug. 28 and affected Solana-based USDC and USDT that customers had moved into their Tria card balances. Tria stressed that its main self-custodial wallets were not compromised, noting that wallet assets and card balances sit in separate systems. Once a user tops up a card with Solana assets, the funds move into a dedicated contract backing the card balance, and it was that contract — not the underlying wallet — that was hit. Assets held in Tria wallets on Solana, EVM networks and Aptos were unaffected, the company said.

Rain upgrades affected programs

Rain said its monitoring systems flagged a vulnerability affecting a small number of programs still running an outdated version of its Solana contracts. The payments infrastructure provider upgraded every program using the affected version and said no further unauthorized activity has been observed. It also engaged third-party forensic specialists and said it would cooperate with law enforcement and relevant regulators. Rain has not disclosed total losses across all affected programs or published a full technical post-mortem.

The impact extended beyond Tria. Solana-focused financial app Avici said 1,685 users had $500,859.22 in card balances affected by the same contract issue, with its self-custodial wallets also untouched. Security firm SlowMist classified the event as a smart-contract vulnerability, saying the affected authorization flow allowed unauthorized administrative access before collateral was withdrawn. Combined disclosures from the two platforms put affected balances above $932,000 across 2,321 users. Because Rain has only described a small number of affected programs, it remains unclear whether other card providers suffered losses.

Rain supplies card infrastructure — issuance, wallets, stablecoin settlement and on- and off-ramps — to fintechs, wallets, neobanks and exchanges. It says its systems support hundreds of businesses and card spending at more than 150 million merchants in over 150 countries, added native Solana support in May 2025, and operates as a Visa Principal Member. That shared model creates efficiency but also concentration risk: a single contract flaw can hit users of multiple consumer brands at once.

The episode highlights where self-custody ends and payment risk begins. Holding assets in a wallet does not remove exposure once those assets are converted into a spendable card balance backed by third-party contracts and authorization systems. Rain's response halted the unauthorized activity and Tria's refunds erased the direct losses for its users; the open question is why live programs were still running a vulnerable contract version, and whether Rain's upgrade procedures will change.