Avici Exploit Nets $670K After Attacker Spends $190

A Solana-based Avici security exploit has left over $1 million in user funds exposed after an attacker reportedly used just $190 on gas to drain more than $670,000.

The attack occurred when the attacker funded a new wallet with about $190 in USDC and waited for three hours before interacting with Avici's Solana card contracts at 16:49 UTC.

Between 18:19 and 18:34 UTC, the first major batch of around $576,000 was moved. Further withdrawals pushed the total amount drained above $670,000 across 8,857 transactions.

The exploit targeted individual card-balance contracts due to an outdated signature and permission check in infrastructure provided by Rain, Avici's card-issuing partner.