Avici Attacker Turns $190 Into $670K as Team Refunds Users With 10% Cashback

A Solana-based Avici security exploit has exposed more than $1 million in user funds, after an attacker reportedly spent just $190 on gas before draining over $670,000. Meanwhile, the Avici team has now refunded the affected user in full and added 10% cashback after identifying and fixing the contract issue.

How Attacker Used $190 in Gas to Drain $670K

According to on-chain data, the attacker funded a new wallet with about $190 in USDC, mainly to cover transaction fees. After staying inactive for around three hours, the wallet began interacting with Avici’s Solana card contracts at 16:49 UTC.

The attacker then started draining individual user balances. The first major batch of about $576,000 was moved between 18:19 and 18:34 UTC. 

The Avici attacker turned $190 into $670000 🔥

Wallet created yesterday at 13:40 UTC. Funded with $190 USDC bridged from Ethereum – just enough for gas. Drain started at 16:49. 8,857 transactions and counting.

Same pattern on every account:

1. submit a signature bundle
2.…

— Officer's Notes (@officer_secret) August 29, 2026

Further withdrawals pushed the total amount drained above $670,000, while the attack continued across 8,857 transactions.

As the attacker kept accessing user accounts, the total platform losses eventually exceeded $1 million.

One Contract Flaw Exposed 1,100+ Accounts

The attacker did not break into Avici’s main treasury or steal an upgrade key. Instead, the exploit targeted individual card-balance contracts.

The issue involved an outdated signature and permission check in infrastructure provided by Rain, Avici’s card-issuing partner.

The attacker submitted a specially created signature bundle, called AddCollateralAdmin, which incorrectly gave them admin access to more than 1,100 user collateral accounts.

The attacker could then withdraw funds from those accounts one by one. On-chain data showed a median withdrawal of $24, while the largest withdrawal in the sample was $5,268.

Avici Refunds Users With 10% Cashback

Avici said it has updated the affected Solana contract and has not seen further related activity.

UPDATE: Refunds are processed in full, with an extra 10% cashback.

The Solana contract has been updated. We haven't seen any further related activity, and we're constantly monitoring it.

If your Solana card balance was withdrawn a few hours ago, we've restored the full amount… https://t.co/NTs0goOb4Q pic.twitter.com/FJm8dES7K9

— Avici (@avici) August 29, 2026

The team also confirmed that affected balances were restored in full, with an additional 10% cashback on the amount withdrawn.

“If your Solana card balance was withdrawn a few hours ago, we’ve restored the full amount and added 10% cashback on what was withdrawn.”

Avici said the exploit was limited to Solana card contracts holding balances added through its Top Up system. Regular Solana and EVM wallets, along with EVM card balances, onramps, offramps and swaps, were not affected.

While, Avici says it is continuing to monitor the updated contracts while users are being asked to check their restored balances.