Rain Identifies Solana Card Contract Vulnerability…

Crypto card infrastructure provider Rain said a vulnerability in an outdated version of its Solana card contracts allowed unauthorized withdrawals affecting 1,685 users of crypto neobank Avici, exposing $500,859.22 in customer card balances. The incident occurred on Aug. 28 and was confined to the contracts used to hold funds transferred into Avici's Solana card system.

Avici stressed that its regular Solana and EVM wallets are self-custodial and were not affected. Users only became exposed after manually moving assets from those wallets into a separate smart contract used to fund their cards. Rain said its monitoring systems discovered the vulnerability, which affected a small number of programs still running an outdated version of its Solana contracts. All affected deployments have since been upgraded, and Rain observed no further unauthorized activity after the remediation.

Authorization flaw, not a key compromise

On-chain analysis indicates the attacker exploited the contract's authorization process rather than Solana itself or users' private keys. The attack involved repeated calls to functions including SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset. Researchers found the attacker could submit signatures and abuse a flaw in the verification process to obtain administrative authority over collateral accounts, after which assets could be systematically withdrawn from individual card-balance accounts. The attacker reportedly started with less than $200 to establish the attack wallet and pay transaction costs.

Early blockchain monitoring produced loss estimates above $1 million. CertiK, for example, tracked an attacker transferring 10,000 SOL before converting roughly $1.02 million into USDC and moving value toward Ethereum. Those figures should not be read as Avici's loss: the vulnerable Rain contract version was also used by other programs. Avici's completed reconciliation identified exactly 1,685 affected customers and $500,859.22. Tria separately reported 636 affected users and approximately $431,945 in impacted balances.

Rain committed to making all affected customers whole and engaged third-party forensic specialists while working with law enforcement and relevant regulators. Avici confirmed Rain funded the reimbursements and that all affected balances had been restored, and credited affected customers an additional 10% cashback on the amount withdrawn. EVM card balances, swaps, onramps and offramps were unaffected, the company said. Avici also filed a report with the FBI's Internet Crime Complaint Center and said a complete postmortem will follow once the investigation concludes.