Unauthorized Access Hits Solana-Based Card Infrastructure, Roughly $500,000 Drained from 1,685 Users’ Balances — BigGo Finance

Rain, which provides Solana-based stablecoin-collateralized cards, had its contracts attacked externally on the 28th (UTC), resulting in funds being drained from card balances at partner neobanks. Damage was confirmed at Avici and Tria, with Avici disclosing that $500,859.22 (approximately ¥8 million) was fraudulently withdrawn from the card balances of 1,685 users.

According to Avici, self-custody Solana and EVM wallets were unaffected. The damage was confined to separate contract balances where users had moved stablecoins for card usage, with the legacy version of Rain’s card balance management infrastructure being targeted. The company has filed a report with the FBI’s Internet Crime Complaint Center (IC3).

Attack Exploited Vulnerability in Legacy Contracts

Rain explained that the attack vector stemmed from some partners, including Avici, continuing to operate legacy versions of Solana contracts. All targeted contracts have since been updated, and no malicious activity has been confirmed following the fixes.

According to analysis by security researchers, the attacker used spoofed signature data to grant unauthorized administrator privileges to users’ card balance contracts, then repeatedly executed procedures to withdraw collateral assets. The first malicious operation was confirmed at 16:49:48 UTC, and the attacker’s address ultimately signed 14,672 transactions, of which 2,344 failed.

In one transaction, 2,346.77 USDT was withdrawn from a single collateral account. The attacker’s wallet had received only 1.79 SOL via deBridge before the attack began, swapping portions of the drained stablecoins into SOL as the exploit progressed.

Funds Routed to Tornado Cash

The stolen funds are believed to have been bridged to Ethereum and then sent in multiple batches to the anonymization service Tornado Cash. Criticism emerged on social media over the fact that stablecoin issuer Circle did not freeze the USDC.

Rain has not yet published a formal technical root-cause report but is conducting a forensic investigation with a third-party firm and plans to coordinate with law enforcement and relevant regulatory authorities.

Full Compensation Pledged; Refund Source Undisclosed

The response has moved into the compensation phase. Rain has promised full reimbursement to all victims, and Avici has indicated it will refund the entire amount of approximately $500,859 that was drained. Tria has also pledged full compensation to victims.

However, the specific timing of refunds and whether Rain or Avici will bear the cost have not been disclosed. There has also been no official announcement regarding the number of victims or the amount of damage at Tria.

AVICI Token Rebounds After Plunge

Avici’s token price plunged after the exploit came to light, selling off to an all-time low of around $0.219 as users began reporting missing card balances. That level is roughly half of the intraday high of $0.446. Following the announcement of the refund policy, the token rebounded to around $0.27, but it remains down approximately 38% on a 24-hour basis, with a market capitalization of about $3.4 million (approximately ¥540 million) and 24-hour trading volume of about $1.2 million (approximately ¥190 million).

This incident bears structural similarities to the Raydium exploit in June, in that a vulnerability remained in legacy contracts that had disappeared from the current interface. In the Raydium case, a flaw remained in the logic of old liquidity pools that had already been removed from the current UI, and those pools became the target of the attack. Another Solana-based protocol, Allbridge Core, also suspended operations in July after a flash loan attack manipulated the accounting of its stablecoin pools, resulting in over $1 million (approximately ¥160 million) in losses.

The series of incidents demonstrates that the problem lies not in the design of separating dedicated card-balance contracts from self-custody wallets per se, but in legacy contract versions not being properly deprecated and remaining in place. Users were only exposed to risk once they moved assets from their wallets to card contracts, while the self-custody wallets themselves remained secure.