Avici Bank Hacked, Over $1 Million in User Funds Stolen on Solana Blockchain

A new bank on the Solana blockchain called Avici has been hacked, with attackers making off with over $1 million in user funds. The hackers' wallet now holds approximately $1.07 million worth of SOL and around $11,600 in USDC and USDT.

The attack pattern involved calling Avici's authorization program SubmitSignatures, then AddCollateralAdmin on the lending program, before executing WithdrawCollateralAsset to extract the funds. Notably, both programs are upgradeable and share the same Solana account without multi-signature permissions.

Avici only acknowledged the issue over an hour after the first theft, stating they were 'aware of the problem affecting withdrawals' and working directly with partners to resolve it.