Crypto Cards' Hidden Risk: Loaded Balance Vanishes Without Compromised Private Keys
On August 28, 2026, an attack on Avici's Solana card contract left users' self-custodied wallets untouched, but the loaded card balance was gone.
The incident showed that the money backing a crypto card frequently does not sit in your own wallet. Instead, it sits in a separate container operated by the card platform and filled by you when you top up.
Avici is a neobank on the Solana blockchain that attaches a Visa card to an on-chain account of its own. The provider disclosed that there was a problem with card payouts on August 28, 2026, after the first malicious transaction occurred at 16:49:48 UTC.
The attacker exploited the payout logic of Avici's program written in Rust by calling the functions SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset one after another. The middle step allowed the attacker to enter himself as an authorized administrator of the collateral and withdraw what had been deposited through the regular route.
The attack series comprised 14,672 transactions, with 2,344 failing. This points to an automated script working through the contract systematically over hours rather than a one-off strike.