Five Neobanks and Crypto Platforms Fall to Same Basic Security Mistakes

A series of hacks targeting neobanks and crypto platforms has resulted in significant losses over the past month. The incidents, which include five confirmed cases, demonstrate a pattern of vulnerabilities that highlight the importance of thorough security testing.

The first incident occurred on August 28 when an attacker exploited an outdated version of a Solana card contract built by Rain, draining $500,859 from Avici's card balances tied to 1,685 users. The same vulnerability was also used to drain $431,945 from Tria's customers' card balances.

A two-week gap followed before another incident occurred on September 11 when a security firm flagged a missing access control in the AtomicQueue contract's solve() function at ether.fi. This allowed an attacker to force victim wallets into acting as 'solvers,' draining funds through pre-existing ERC-20 approvals.

The largest loss came from Payy Network, where an attacker exploited its Ethereum rollup contract on September 24, extracting $1.83 million in USDC and swapping it for 683.38 ETH.

These incidents demonstrate that even well-known platforms with a strong reputation can fall victim to basic mistakes, such as outdated contracts or trusting forged emails. The shared-infrastructure pattern is evident across the five incidents, underscoring the need for thorough security testing.