Security Breach at Avici Affects Card Balances of 1,685 Users
Vulnerability in Solana-based card contract causes 28% token price drop.
1Discovery of the Vulnerability
Avici identified a security flaw in the Solana blockchain-based card balance contract. The vulnerability affected 1,685 users with total card balances worth $500,859. The company confirmed users' self-custody wallets remained secure and promised full reimbursement. The issue was detected by card processing partner Rain on August 28, 2026, prompting immediate action.
2Technical Details of the Attack
Blockchain researcher Nikita analyzed that the attacker used a wallet funded with $190 in USDC. Exploiting an authorization flaw in the Solana contract, the attacker granted themselves admin privileges. This allowed control over 1,100+ accounts. The bug permitted re-verification of the attacker's own signature during secondary validation, bypassing security checks.
3Financial Impact Assessment
During the attack, 8,857 transactions were executed draining individual accounts. The largest single withdrawal reached $5,268. CertiK Alert reported the attacker converted 10,000 SOL to $1.02 million USDC, then to 418 ETH sent to Tornado Cash. Avici's official statement confirmed total losses at $500,859 and initiated reimbursement procedures.
4Token Market Reactions
News of the breach caused Avici's native token AVICI to plummet 28% to $0.3086, according to CoinMarketCap data. This reflected shaken market confidence. The company emphasized the contract update didn't require changing the deployment key, unused since March 2025. The incident highlighted vulnerabilities in multi-signature authorization mechanisms.
5Recovery and Remediation
Avici committed to fully restoring all affected card balances. The company filed reports with FBI's Internet Crime Complaint Center (IC3) and continues collaborating with security partners. Contract updates were completed across all programs with no new unauthorized transactions detected. Users' self-custody Solana and EVM wallets remained unaffected throughout the incident.
6Broader Industry Context
The crypto sector suffered over 200 hack attacks in H1 2026, totaling $3.63 billion in losses per CoinGecko. The Avici case raised concerns about increasing contract-based attacks targeting card products. Industry experts call for enhanced security audits, particularly for authorization logic in complex smart contract interactions.
7Unique Attack Characteristics
This attack uniquely targeted individual user accounts rather than treasury funds. The attacker moved $576,000 in a single batch transaction. While median account loss was $24, the wide value distribution showed sophisticated targeting. Avici clarified this wasn't a treasury hack but precise exploitation of user accounts.
8Blockchain Security Implications
The Avici incident demonstrates how authorization flaws in complex contract interactions can have cascading effects. It underscores the need for rigorous testing of multi-signature mechanisms. As 2026 sees rising attacks, the industry must develop new security layers to protect user assets. This event particularly highlights risk management challenges in DeFi and card products.
Original article: INCRYPTED — Avici'deki Güvenlik Açığı 1685 Kullanıcının Kart Bakiyesini Etkiledi