Exploit in Avici Affected Card Balances of 1,685 users. Token Plunged 28%

• Avici reported a vulnerability in a Solana contract used to store card balances.
• According to the company, 1,685 users were affected, with a total balance of $500,859.
• Funds in Avici wallets were not affected, and the company promised to fully reimburse all lost card balances.

The Avici protocol confirmed an exploit that led to funds being drained from some users’ individual balances, and on August 29, 2026, announced full reimbursement for those affected. According to the company, the cause was a vulnerability in a version of the Solana card contract used by Avici and several other programs.

Initially, users on X reported a mass withdrawal of funds from Avici card balances to a single address. The company said its wallets and card balances operate separately: users’ self-custodial Solana and EVM wallets were not affected, and only the contract that receives funds after a card top-up was vulnerable.

At the same time, the attack affected the token’s performance. At the time of writing, the AVICI token is down nearly 28% and is trading at $0.3086, according to CoinMarketCap.

How the Exploit Happened

According to data from a blockchain researcher using the pseudonym Nikita, the attacker created an attack wallet and funded it with about $190 in USDC bridged from Ethereum. That amount was enough to cover gas fees during the subsequent attack.

The withdrawals began a few hours later. The researcher noted that, at the time he published his analysis, 8,857 transactions had been executed, and the attack was ongoing.

According to him, the exploit leveraged a flaw in the Solana contract’s authorization mechanism:

• The attacker passed a bundle of signatures
• Via an AddCollateralAdmin call, they assigned themselves as an admin
• After that, they gained the ability to withdraw funds
• An error during the second signature check allowed the contract to revalidate the attacker’s own signature instead of the correct key

As a result, the attacker obtained admin rights over more than 1,100 accounts, and then began systematically withdrawing funds from individual balances.

Crypto Platforms Lost $3.63B to Hacking Attacks since the Start of 2025 — CoinGecko

27.08.2026

Read now

The user noted that the median loss per account was about $24, and the largest single withdrawal in his sample reached $5,268. The attacker moved the first batch of roughly $576,000 out of the attack wallet within 15 minutes.

At the same time, the researcher emphasized that the attack was not a hack of Avici’s treasury: funds were withdrawn directly from users’ individual accounts.

The story is being updated…

Сообщение Exploit in Avici Affected Card Balances of 1,685 users. Token Plunged 28% появились сначала на INCRYPTED.