Avici attack costs Solana users more than $1 million

Attacks on Solana's eco-encryption card platform Avici continue, allegedly stealing more than $1 million from user mortgage accounts and causing its AVICI token price to fall to a record low.

Incident Summary

At a monitoring node, the suspected attacker held 10,005 SOL and approximately US$11,600 stablecoins. Records on the chain show that before extracting collateral, the attacker repeatedly called functions to add administrator privileges. The Avici platform admitted that there was a problem with withdrawing the card balance, but did not confirm the amount of the above loss. AVICI tokens fell 49.4% in 24 hours to hit a historical low of $0.2175.

Attackers first add administrators and then withdraw assets

According to reports, as of 18:58 UTC, suspected attackers have obtained a total of 10,005.03 SOLs (worth approximately US$1.07 million) and approximately US$11,600 in USDC and USDT. The analysis is based on Solana transaction logs and RPC data collected while the attack was still ongoing. The attacker's wallet received initial funds through deBridge at 13:40 UTC, when 1.79 SOL pieces were transferred from another network. After about three hours of silence, the address first called the Avici related program at 16:49:48.

showed that the affected accounts all followed the same three-step operating process. First, the wallet calls the SubmitSignatures function through the Avici authorization program, and the transaction also uses Solana's Ed25519 signature verification program. Subsequently, the attacker called the AddCollateralAdmin function in Avici's collateral program to register additional administrator rights for the victim's account. Finally, the collateral is transferred to an account controlled by the attacker through the Withdraw CollateralAsset function.

In one reviewed transaction, 2,346.77 USDT was transferred from a user's mortgaged account. The attacker also exchanged some stablecoins for SOL, and one exchange earned 209.76 SOL. As of the report monitoring node, the wallet has signed 14,672 transactions, of which 2,344 failed. Within 11 minutes, its SOL position increased by approximately 2,595 positions, which was worth approximately $277,000 at the time.

Anonymous chain analyst STACC has also created a real-time tracker of affected transfers. Based on data cited by the tracker, 125 sending accounts have been identified, with individual transfers ranging from approximately 9 USDC to more than 26,000 USDT.

Currently, neither Avici nor independent security companies have released post-mortem analysis reports explaining how attackers were authorized. Although the transaction sequence shows the flow of funds, it is impossible to determine whether the incident was caused by a program vulnerability, certificate disclosure, signature authority exposure, or other failure.

Avici confirmed card balance withdrawal problem

About 1 hour and 53 minutes after the first transaction involving the Avici program was reported, Avici issued an issue through the X platform admitting the matter. "We have noticed an issue that affects card balance withdrawal and are closely monitoring the situation," the article said. The company added that it is working directly with relevant partners and will update it as soon as more information becomes available. Avici did not call the incident an "attack" and did not confirm the amount stolen or the number of customers affected.

In addition, multiple issues remain unresolved, including whether the attack has stopped, whether Avici has suspended relevant programs, and whether affected users will receive compensation. The company has not disclosed whether any signature keys or management accounts were compromised. Before Avici's statement, users had reported missing balances on social media. One user made it clear that while waiting for information from the project party, the balance of his Avici account had been completely cleared.

This incident involves Avici's card collateral and authorization procedures, not the Solana network itself. There have been no reports of loopholes in Solana's underlying blockchain. According to reports, both Avici programs can be upgraded and share the same upgrade rights. The authority is a standard Solana account and not a multi-signature account, although there is no evidence that the upgrade directly caused or contributed to the withdrawal.

As attacks have transcended smart contract code vulnerabilities, operational control measures have received increasing attention. In July this year, it was reported that of the approximately US$764 million stolen in the second quarter of 2026, 88.3% were caused by breaches of keys, signatories and infrastructure. The report cited a report that found that only 4% of tracked projects had both audits, active vulnerability bounty programs and third-party surveillance.

Avici attack challenges its self-hosting claim

Avici describes its product as a self-managed wallet associated with a secure Visa credit card. According to its app store, users always have control and Avici will never hold user funds. In this card mode, customers deposit cryptocurrency into a mortgage account and receive a corresponding credit line. Consumption reduces the available card balance, and the relevant collateral is subsequently used for settlement.

In this incident, the attacker was able to add another administrator and remove unused collateral, raising questions about how Avici's authorization control mechanism implements its claimed self-managed model. Technical conclusions require Avici or an independent security company to explain why the attacker's signature submission was accepted. Avici's documents show Rain is a partner in its card service. Rain provides stablecoin payment infrastructure and works with licensees to issue cards associated with Visa and MasterCard. Existing transaction analysis points to Avici's Solana program, and neither Avici nor Rain said their systems or Visa systems were compromised.

This distinction is critical for users because self-managed payment products should ensure that unused assets are always under the control of the wallet owner. In November last year, Tangem launched a similar model, in which users use virtual Visa cards to make online USDC purchases while retaining self-custody rights for funds. Payment infrastructure has also faced other wallet-related incidents. In July, on-chain analysts found that wallets associated with stablecoin payment provider Triple-A had suspicious outflows of more than $9.7 million on networks such as Solana, Ethereum, TRON and TON. At the time of the report's release, Triple-A had not confirmed whether customer assets were involved.

AVICI tokens plunged 49% to a record low

According to CoinGecko data, AVICI tokens fell 49.4% to US$0.2175 in 24 hours as reports of withdrawals spread. The sell-off reduced its market value to approximately $2.84 million and its price fell to an all-time low. Trading volume for the same period was approximately US$656,543. The majority of AVICI transactions are conducted through MetaDAO's futarchy automated market makers, with LBank, KCEX and MEXC contributing the remaining trading volume. CoinGecko showed that AVICI's all-time high was US$7.56 (November 26, 2025). The lowest price on the day of the event was down about 97% from its peak.

Avici Inc. is a U.S. company whose website shows an address in San Francisco and whose privacy policy identifies it as a Delaware company. The platform also provides separate card terms for U.S. customers, putting eligible U.S. wallet and crypto card service users at direct risk. The company raised $3.5 million in October 2025 through MetaDAO's limited token sale. MetaDAO's fundraising records show that 7,352 contributors committed approximately US$34.23 million, but Avici refunded approximately 89.8% of the pledged USDC after the app sales cap. The offering prices AVICI at US$0.35, valuing the fully diluted project at approximately US$4.52 million. Avici issued 10 million tokens through sales, accounting for approximately 77.5% of its 12.9 million token supply.