- The Solana card contract flaw affected 1,685 users and $500,859.22 in card balances.
- Avici promised full refunds after Rain upgraded every affected contract.
- Self-custodial Solana and EVM wallets stayed under user control.
A Solana card contract vulnerability affected 1,685 Avici users and $500,859.22 in balances, according to Avici. Rain identified the flaw in an outdated contract version used by several programs. Rain upgraded the affected contracts, while Avici promised full refunds. Meanwhile, AVICI fell to a record low of $0.2175 before recovering near $0.32.
Solana Card Contract Flaw Affects 1,685 Avici Users
The Solana card contract held funds after customers topped up their cards. Avici said the separate balance system, rather than its wallets, suffered the unauthorized withdrawals.
Users retained control of funds in their self-custodial Solana and EVM wallets. Avici said those wallet balances stayed safe throughout the incident.
Rain, Avici’s card-issuing partner, found the vulnerability in an outdated contract version. A small number of other programs used the same version.
Onchain records showed the attacker used admin and withdrawal instructions to move funds. Avici confirmed $500,859.22 in user losses, while the attacker’s wallet moved 10,000 SOL across affected programs.
That contract separation limited the confirmed exposure to topped-up card funds during the incident. It also explains why wallet balances remained available during remediation and the wider response.
Solana Card Contract Upgrade Stops Unauthorized Activity
The upgraded Solana card contract has shown no further unauthorized activity, Avici said. Rain updated every affected program and engaged outside forensic specialists.
Avici will refund all $500,859.22 across the 1,685 affected card balances. The company also filed a report with the FBI Internet Crime Complaint Center.
Avici continues working with Rain and security partners while monitoring remediation. Rain also plans to cooperate with law enforcement and relevant regulators.
Token data showed AVICI trading near $0.32 after touching $0.2175, its record low. The price stayed far below its $7.56 November 2025 peak.
This incident affected a third-party card balance contract, not the Solana network itself. No evidence in Avici’s disclosure linked the flaw to Solana’s core protocol.
Rain has not disclosed how long the outdated contract remained active. Neither company has explained how the attacker first identified the vulnerability.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
