An attacker drained over $653,000 from card collateral vaults at Avici, a Solana neobank whose own documentation promised that only a users wallet could ever move that money.
The token Avici (AVICI) has since fallen by about 40% to $0.24. The sum taken equals close to a fifth of its entire market value.
AVICI Price Performance. Source: CoingeckoWhat the Avici Exploit Broke
Avici sells a Visa credit card backed by USDC. Users lock the stablecoin in a smart contract, and spending draws it down. Third National issues the card, not Avici.
“Only user‘s wallet can withdraw funds from escrow contract after deducting the spends,” the company’s documentation states, indicating who holds the keys.
On Friday, the vaults emptied anyway, with a live tracker counting $653,548 pulled out as of this writing
Discover more
Trading Foreign Currencies Online
NEWS
FINANCE
Avici Attack. Source: Live Tracker
Self-custody set out who could not take the money. It did not remove every privileged path written into the program itself. That gap is where the funds went.
On-chain researchers say the attacker submitted a crafted signature bundle, made itself an admin on the escrow accounts, then withdrew. Avici has not confirmed that method.
more info on the ongoing
Follow us on X to get the latest news as it happens
Why This Is Not a Treasury Hack
Each customer holds a separate escrow contract. So the money was left account by account. There was no single pot to empty.
It suggests a familiar pattern, such as when a Solana governance attack took $20 million from one BONK DAO treasury in a single stroke.
Associated tokens rarely shrug such incidents off, which is why the AVICI token fell almost 40%. In the same way, a bridge breach sent Midnights token to a record low in July.
Midnight (NIGHT) Token Price Performance. Source: BeInCrypto Markets
Avici has said only that it is aware of an issue affecting card balance withdrawals. No post-mortem has followed.
Were aware of an issue affecting card balance withdrawals and are closely monitoring the situation.
Were working directly with all relevant partners to resolve it and will share updates as soon as we have more information.
The company has not said whether the remaining vaults can still be called, or whether card settlement with Third National is affected.
The post Solana Neobank Avici Hacked for $650,000. Token Crashes 40% appeared first on BeInCrypto.