Avici Attack Exposes Weakness in Self-Custody Crypto Card Platform

A Solana-based crypto card platform called Avici has been attacked, resulting in over $1 million being drained from user collateral accounts. The attacker used an exploit to add administrators and remove unspent collateral before making withdrawals.

The attack took place on the Solana network, with the wallet involved receiving its initial funding through deBridge at 13:40 UTC. Over a period of several hours, the attacker made repeated calls that added an administrator before withdrawing funds from user accounts.

The attack has left Avici's AVICI token trading at an all-time low, with a market capitalization of approximately $2.84 million. The platform's self-custody claims have been challenged by the incident, which highlights the importance of robust authorization controls in protecting user funds.