Avici Neobank Hit by $1 Million Attack, Users Left Reimbursement Uncertain

A Solana neobank called Avici was hit by an attacker who drained more than $1 million from user accounts. The attacker exploited a vulnerability in Avici's authorization layer, using it to call instructions that registered new administrators on users' collateral accounts and then withdrew the balances.

The attack started at 16:49 UTC and continued for nearly two hours before Avici acknowledged the issue. During this time, the attacker's wallet held 10,005 SOL worth around $1.07 million and made periodic transactions to swap stablecoins into SOL.

Avici said it is working with partners to resolve the issue but has not provided details on how many accounts are affected or whether users will be reimbursed for their losses.