Rain Exploit Drains About $1.1 Million From Solana Crypto Debit Card Infrastructure

Rain, a Solana-based crypto debit card infrastructure provider, was hacked through a vulnerability in an outdated contract, and about $1.1 million was stolen. According to ChainCatcher, the attack affected card funding contracts used for top-ups and spending, while self-custody wallets were not impacted. Avici said it will fully reimburse affected balances. The company said 1,685 Avici users lost about $500,800, while another crypto bank, Tria, had 636 affected users with losses of more than $430,000. The gap between the on-chain trace of about $1.1 million and Avici's reported losses suggests other Rain-supported protocols may also have been targeted. Transaction data showed the attacker repeatedly submitted signature approvals, added themselves as an administrator of a card collateral account, and withdrew balances. The stolen stablecoins were swapped into SOL, bridged to Ethereum, and then sent to Tornado Cash. Avici said it has reported the incident to the FBI Internet Crime Complaint Center.