Avici Solana exploit drains over $1M

A security exploit targeting the Solana-based crypto card platform Avici drained more than $1 million from user collateral accounts on August 28, 2026, before the company issued a full refund with additional compensation. The attack, which exploited a flaw in the platform's authorization system, sent the native AVICI token to an all-time low and raised questions about the security of self-custodial payment models.

The incident began at approximately 16:49 UTC on August 28, when an attacker's wallet, funded with about $190 in USDC for gas fees, started interacting with Avici's Solana card contracts. On-chain data shows the attacker used a three-step process to drain funds: first calling SubmitSignatures on Avici's authorization program, then AddCollateralAdmin on the collateral program to register as an administrator on a user's account, and finally WithdrawCollateralAsset to transfer the funds. The attack continued across thousands of transactions, with the first major batch of about $576,000 moved between 18:19 and 18:34 UTC. The total amount drained eventually exceeded $1 million, affecting over 1,100 user accounts.

Avici acknowledged the issue in a post at 18:42 UTC, nearly...