$500K Stolen in Avici Solana Neobank Hack
On August 28, Avici's Solana neobank suffered a significant security breach when an attacker exploited a vulnerable Rain card contract, draining $500,859.22 from the card balances of 1,685 users.
The attack is believed to have started with a small amount of SOL being funded into an attacker-controlled wallet through deBridge at around 13:40 UTC, which then sat dormant for approximately three hours before interacting with Avici's programs.
According to Block Stream Media's review of the logs, the attacker used a combination of SubmitSignatures and AddCollateralAdmin on the collateral program, followed by WithdrawCollateralAsset to pull assets from user collateral accounts.
Rain had upgraded the affected contract across all programs following the breach, and Avici has promised full reimbursement to affected users, with an additional 10% cashback on withdrawn amounts already processed.
However, the incident highlights concerns about the security of neobank-style crypto products, which often rely on complex chains of contracts and issuers that can be vulnerable to exploitation.