Solana Card Program Hack Exposes Vulnerability in Rain's Outdated Contracts

A recent security incident involving Avici and its card-infrastructure partner Rain drained roughly $1 million to $1.1 million from Solana-based card programs on August 28, 2026.

The attack targeted users who had moved their assets into a separate smart-contract account to support card authorizations and settlement.

Rain has confirmed that the vulnerability existed in an outdated version of its Solana contracts, which allowed attackers to bypass authorization checks and transfer funds out of user accounts.