Avici Users Lose Over $1M as Live Attack Exploits Neobank Vulnerability

An attacker has drained more than $1 million from Avici users in a live Solana neobank attack, according to recent reports. The attacker exploited an authorization layer vulnerability in Avici's system, which issues Visa cards backed by users' crypto.

The attacker withdrew funds from customer accounts using a pattern of transactions that involved adding an administrator to a user's collateral account and then withdrawing the balance. This allowed the attacker to drain $1.07 million worth of SOL, as well as smaller amounts of USDC and USDT.

Avici said it is working with relevant partners to resolve the issue, but has not provided information on how many accounts are affected or whether users will be reimbursed for their losses.