$1M Stolen from Avici as Hacker Uses Tornado Cash to Launder Funds

The Solana-based neobank Avici has fallen victim to a hack that has resulted in losses exceeding $1 million. The attacker exploited vulnerabilities in the bank's smart contract permissions and signature verification, allowing unauthorized withdrawals of funds.

The stolen SOL was swapped for USDC and then bridged to Ethereum before being deposited into Tornado Cash, a crypto mixing service that obscures transaction trails.

Security experts point to weaknesses in Avici's smart contract permission controls as likely entry points, which allowed the attacker to manipulate transaction parameters or forge signatures.