Avici Security Exploit Exposes Over $1 Million in User Funds

Avici, a Solana-based platform, has suffered a security exploit that exposed over $1 million in user funds. The attacker reportedly spent just $190 on gas before draining an estimated $670,000 from individual user balances.

The attack began around 16:49 UTC when the wallet started interacting with Avici's Solana card contracts. Over the next few hours, the attacker drained funds from more than 1,100 user collateral accounts through a specially created signature bundle that incorrectly gave them admin access.

Avici has confirmed that the exploit was limited to Solana card contracts holding balances added through its Top Up system and did not affect regular Solana or EVM wallets. The team has now restored affected balances in full and offered 10% cashback on the amount withdrawn.