Avici Suffers $500K Security Breach via Rain's Stablecoin Payment Infrastructure

A self-custodial Solana-based neobank called Avici suffered a security breach on August 28, allowing an attacker to drain collateral from user card vaults. The company confirmed the issue within two hours and stated it was 'aware of an issue affecting card balance withdrawals' while working with partners on a fix.

The attack exploited a flaw in Rain's stablecoin payment infrastructure provider that issues Visa- and Mastercard-linked cards for Avici and other crypto neobanks. Tria, another self-custodial card app, also uses Rain's issuing infrastructure, but it is unclear whether its user funds were affected.

The attacker used the exploiter to call SubmitSignatures on Avici's authorization program, AddCollateralAdmin on the collateral program, and WithdrawCollateralAsset to pull the funds out. The breach affected 1,685 users and resulted in a loss of $500,859.22, according to Avici.

The stolen SOL was converted into USDC and then transferred to Tornado Cash, where it was mixed with other funds. This incident highlights the importance of operational security and the need for multi-signature wallets to prevent such breaches.