CRYPTO BANK Avici Hit by Contract Exploit, Token Falls 49%

Avici, a crypto digital bank, was hit by a smart contract exploit that caused about $1.1 million in losses, and its native token AVICI fell from a 24-hour high of $0.43 to an all-time low of $0.217 before rebounding to about $0.378. According to Sina Finance, the incident exposed security risks in the funding flow of self-custody crypto cards. The attacker used a vulnerability in an outdated version of the Rain card contract, repeatedly submitting signed authorization transactions, adding itself as administrator of certain card collateral accounts, and withdrawing balances. The stolen stablecoins were converted into Solana blockchain tokens, moved through a cross-chain bridge to the Ethereum network, and ultimately sent to Tornado Cash. On-chain data showed that of the roughly $1.1 million stolen, about $500,800 in losses involved 1,685 Avici users, while more than $430,000 in losses involved 636 Tria users. Tria said it would fully compensate users, and its token at one point fell more than 10%. Avici said the attack was limited to the Solana contract where user funds are stored after deposits, and that its self-custody wallets on Solana and Ethereum-compatible networks were not affected. The company said it would fully reimburse affected users' card balances. Rain said its monitoring system identified the vulnerability, upgraded all programs running that contract version, and found no further abnormal activity. Avici's terms of service show that its cards are issued by Third National, while Rain provides the underlying stablecoin card infrastructure as a major Visa member. The companies did not disclose any other affected projects or the total amount of losses. Avici said it had filed a report with the FBI Internet Crime Complaint Center, but it has not announced a compensation timeline or funding source.