Avici Solana exploit drains over $1M

A security exploit targeting the Solana-based crypto card platform Avici drained more than $1 million from user collateral accounts on August 28, 2026, before the company issued a full refund with additional compensation. The attack, which exploited a flaw in the platform's authorization system, sent the native AVICI token to an all-time low and raised questions about the security of self-custodial payment models. The incident began at approximately 16:49 UTC on August 28, when an attacker's wallet, funded with about $190 in USDC for gas fees, started interacting with Avici's Solana card contracts.