Avici Attacker Nets $670K After Spending Just $190 on Gas

An attacker exploited a vulnerability in Solana-based Avici's security system, draining over $670,000 from user funds.

The exploit occurred after an attacker spent just $190 on gas to fund a new wallet. The attacker then interacted with Avici's card contracts at 16:49 UTC and began draining individual user balances.

Further withdrawals pushed the total amount drained above $670,000, while the attack continued across 8,857 transactions.

The issue involved an outdated signature and permission check in infrastructure provided by Rain, Avici's card-issuing partner. The attacker submitted a specially created signature bundle called AddCollateralAdmin, which gave them admin access to over 1,100 user collateral accounts.

Avici has updated the affected Solana contract and restored affected balances in full, with an additional 10% cashback on the amount withdrawn.