Avici Neobank Loses Over $500K in Smart Contract Exploit

This exploit underscores systemic risks in decentralized finance (DeFi) platforms, particularly those relying on outdated smart contracts.

• On August 28, 2026, Avici, a Solana-based neobank, suffered a smart contract exploit that drained over $500,000 from user card balances.
• The attack exploited a vulnerability in an outdated contract from card-issuing partner Rain, allowing unauthorized withdrawals from collateral accounts.
• Avici has pledged full refunds to affected users and reported the incident to the FBI, while parallel phishing campaigns have caused additional losses exceeding $600,000.

• Avici operates as a self-custodial neobank, allowing users to maintain control over their funds while providing services like Visa spend cards.
• The exploit was made possible due to a flaw in a legacy smart contract, revealing the risks associated with relying on third-party contracts in DeFi.
• Phishing attacks targeting Avici users have been ongoing since late 2025, indicating a broader trend of cyber threats in the crypto space.

On August 28, 2026, Avici's neobank platform fell victim to a smart contract exploit that drained approximately $500,859.22 from the card balances of 1,685 users. The exploit was executed by an attacker who spent around $190 to manipulate an outdated version of a Solana contract operated by Rain, Avici's card-issuing partner. The attacker leveraged a series of chained contract calls—SubmitSignatures, AddCollateralAdmin, and WithdrawCollateralAsset—to gain unauthorized admin access to collateral accounts, enabling them to withdraw funds.

The exploit's impact was significant, as it affected multiple programs utilizing the legacy contract, with Avici's losses being the most pronounced. On-chain activity revealed that the attacker quickly transferred 10,000 SOL to obscure their tracks, bridging the funds to Ethereum and mixing them via Tornado Cash. Avici confirmed the exploit within hours, assuring users that their self-custodial wallets remained untouched and committing to full refunds for those affected.

In the aftermath, the AVICI governance token experienced a sharp decline of 40-49%, reaching record lows before a partial recovery. This incident has raised broader concerns about the security of Solana-based neobanks and the reliability of their card products. Rain has since upgraded the affected contracts to mitigate future risks, but the incident has left a lingering caution among users and investors alike.

Moreover, the parallel phishing campaigns that emerged during this period have compounded user losses, with reports indicating that these scams have collectively drained over $600,000 from Avici users. This highlights the dual threat of smart contract vulnerabilities and social engineering attacks in the crypto space, emphasizing the need for enhanced security measures and user education.

• Crypto users: Individuals using Avici's services are directly impacted by the loss of funds and the potential for further phishing attacks.
• Investors in AVICI token: Those holding the token have seen significant value loss, affecting their investment portfolios.
• DeFi platforms: Other decentralized finance services may face increased scrutiny and caution from users, impacting their growth and adoption rates.
• Regulatory bodies: Increased incidents may prompt regulators to impose stricter guidelines on DeFi platforms, affecting operational frameworks.

• Contract upgrades: Monitor how quickly and effectively Avici and Rain implement security upgrades to prevent future exploits, as this will influence user trust.
• Market response: Watch for fluctuations in the AVICI token price and user engagement levels, which may indicate broader market sentiment towards Solana-based neobanks.
• Phishing trends: Keep an eye on the evolution of phishing tactics targeting crypto users, as these could lead to further losses and necessitate enhanced security protocols.