Attacker Drains Over $1 Million From Avici Users in Live Solana Neobank Attack

An attacker has siphoned more than $1 million from users of Avici, a Solana‑based neobank that issues Visa‑linked cards backed by on‑chain crypto balances. The breach was detected in real time, and the attacker’s wallet continued to receive funds as the incident unfolded.

How the Attack Unfolded

Avici’s cards are marketed as self‑custodial, with balances stored in on‑chain accounts that users access via passkey‑based authorization rather than seed phrases. The attacker bypassed this layer by invoking a sequence of contract calls that added a new administrator to a victim’s collateral account and then withdrew the assets.

Transaction Pattern

• The attacker’s wallet (address FVNFzq[…]QnCEj) held 10,005.03 SOL (≈ $1.07 million) and about $11,600 in USDC and USDT at 18:58 UTC.
• Initial funding came from a 1.79 SOL bridge transaction at 13:40 UTC; the first contract call to Avici occurred at 16:49:48 UTC.
• Since then the wallet signed 14,672 transactions (2,344 failed), repeatedly executing three instructions: SubmitSignatures, AddCollateralAdmin, and WithdrawCollateralAsset.
• One observed withdrawal moved 2,346.77 USDT from a user’s collateral account to the attacker’s token account.
• Stablecoins taken are periodically swapped into SOL, adding roughly 209.76 SOL in a single fill.

Avici’s Response

Avici posted at 18:42 UTC that it was “working directly with all relevant partners to resolve it and will share updates as soon as we have more information.” The public acknowledgment came 1 hour 53 minutes after the first drain transaction. Users reported missing balances on social media shortly thereafter.

Market Impact

Following the incident, the AVICI token fell to $0.2175, a 49.4 % drop over 24 hours, with a market cap of $2.84 million and 24‑hour volume of $656,543 (CoinGecko). The token now trades at roughly 62 % of its ICO price.

Broader Context

Wallet‑level compromises have become a notable source of loss in 2026, with incidents ranging from Trust Wallet’s $7 million browser extension hack to Coldcard hardware thefts. In Q2 2026, DeFi reported about 70 exploits resulting in $746 million stolen, marking the most‑hacked quarter on record.