The wallet behind the attack held 10,005 SOL at press time and was still taking funds. Avici said it was “aware of an issue affecting card balance withdrawals” nearly two hours after the first drain transaction.
An attacker is draining customer funds from Avici, the Solana neobank that issues Visa cards backed by users’ crypto, and had taken more than $1 million by press time.
Avici sells its card as self-custodial, with balances held in onchain accounts users authorize through passkeys instead of seed phrases. The attacker went through that authorization layer, calling an instruction that registers a new administrator on a user’s collateral account and then withdrawing the balance.
The attacker’s wallet, FVNFzq[…]QnCEj, held 10,005.03 SOL worth about $1.07 million at 18:58 UTC, plus roughly $11,600 in USDC and USDT, according to Solana RPC data queried by The Defiant. Its SOL balance grew by about 2,595 tokens, some $277,000, in the previous 11 minutes.
Avici said in a post at 18:42 UTC that it is “working directly with all relevant partners to resolve it and will share updates as soon as we have more information.” The company has not said how the funds were taken, how many accounts are affected, or whether it will make users whole.
Add Admin, Then Withdraw
The wallet was funded with 1.79 SOL bridged through deBridge at 13:40 UTC and sat idle for three hours. Its first call against Avici’s contracts landed at 16:49:48 UTC. It has since signed 14,672 transactions, 2,344 of which failed.
The pattern repeats per victim across three instructions, according to transaction logs. The wallet first calls SubmitSignatures on Avici’s authorization program, in a transaction that also invokes Solana’s Ed25519 signature-verification precompile. It then calls AddCollateralAdmin on Avici’s collateral program, and finally WithdrawCollateralAsset on the same program.
In one transaction reviewed by The Defiant, a single WithdrawCollateralAsset call moved 2,346.77 USDT from a user’s collateral account to the attacker’s token account. The wallet periodically swaps the stablecoins it takes into SOL. One fill added 209.76 SOL.
Both Avici programs are upgradeable and share the same upgrade authority, a plain Solana account rather than a multisig.
Two Hours To Acknowledge
Avici’s acknowledgment came one hour and 53 minutes after the first drain transaction. Users had been posting about missing balances before it went up.
“i just got drained of all my balance from my @avici acc,” one user wrote at 18:44 UTC. “waiting to hear from the project.”
A live tracker built by the pseudonymous onchain analyst STACC counted 125 distinct sending accounts in its window and inbound transfers ranging from about 9 USDC to more than 26,000 USDT.
AVICI Halves To Record Low
AVICI traded at $0.2175, down 49.4% over 24 hours, with a market capitalization of $2.84 million on $656,543 of 24-hour volume, according to CoinGecko. The token set a record low on Friday, having reached $7.56 on Nov. 26, 2025.
The token trades mostly on MetaDAO’s futarchy automated market maker, which handles about 58% of volume, with the rest split across LBank, KCEX and MEXC.
Refunded 90% At Launch
Avici raised through MetaDAO in October 2025 in one of the launches that revived the ICO on Solana. The team capped the sale at $3.5 million against $34,206,976 in commitments, refunding 89.8% of committed USDC and setting an initial price of $0.35 on a $4,515,000 fully diluted valuation across a 12.9 million token supply. AVICI now trades at about 62% of that ICO price.
The company is registered as Avici Inc. in San Francisco. It said on Aug. 24 it would be among the first neobanks to offer Coinbase’s tokenized stocks on Base.
Wallet-level compromises have accounted for a growing share of 2026 losses, from Trust Wallet’s $7 million browser extension hack to the Coldcard hardware wallet thefts. DeFi recorded about 70 exploits and $746 million stolen in the second quarter, the most-hacked quarter on record.
Be the first to comment