A Solana-based Avici security exploit has exposed more than $1 million in user funds, after an attacker reportedly spent just $190 on gas before draining over $670,000. Meanwhile, the Avici team has now refunded the affected user in full and added 10% cashback after identifying and fixing the contract issue.
How Attacker Used $190 in Gas to Drain $670K
According to on-chain data, the attacker funded a new wallet with about $190 in USDC, mainly to cover transaction fees. After staying inactive for around three hours, the wallet began interacting with Avici’s Solana card contracts at 16:49 UTC.
The attacker then started draining individual user balances. The first major batch of about $576,000 was moved between 18:19 and 18:34 UTC.
The Avici attacker turned $190 into $670000 🔥
Wallet created yesterday at 13:40 UTC. Funded with $190 USDC bridged from Ethereum – just enough for gas. Drain started at 16:49. 8,857 transactions and counting.
Same pattern on every account:
1. submit a signature bundle2.…
— Officer’s Notes (@officer_secret) August 29, 2026
Further withdrawals pushed the total amount drained above $670,000, while the attack continued across 8,857 transactions.
As the attacker kept accessing user accounts, the total platform losses eventually exceeded $1 million.
One Contract Flaw Exposed 1,100+ Accounts
The attacker did not break into Avici’s main treasury or steal an upgrade key. Instead, the exploit targeted individual card-balance contracts.
The issue involved an outdated signature and permission check in infrastructure provided by Rain, Avici’s card-issuing partner.
The attacker submitted a specially created signature bundle, called AddCollateralAdmin, which incorrectly gave them admin access to more than 1,100 user collateral accounts.
The attacker could then withdraw funds from those accounts one by one. On-chain data showed a median withdrawal of $24, while the largest withdrawal in the sample was $5,268.
Avici Refunds Users With 10% Cashback
Avici said it has updated the affected Solana contract and has not seen further related activity.
The team also confirmed that affected balances were restored in full, with an additional 10% cashback on the amount withdrawn.
“If your Solana card balance was withdrawn a few hours ago, we’ve restored the full amount and added 10% cashback on what was withdrawn.”
Avici said the exploit was limited to Solana card contracts holding balances added through its Top Up system. Regular Solana and EVM wallets, along with EVM card balances, onramps, offramps and swaps, were not affected.
While, Avici says it is continuing to monitor the updated contracts while users are being asked to check their restored balances.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
