Solana Neobank Avici Loses Over $650,000 in Exploit, Token Drops 40%

An attacker exploited Avici, a Solana‑based neobank that issues a Visa‑compatible card backed by USDC, and withdrew over $650,000 from the platform’s escrow vaults. The loss represents roughly one‑fifth of the token’s total market value and triggered a sharp decline in the AVICI token price.

How the Exploit Worked

Avici’s documentation states that only the user’s wallet can move funds from the escrow contract after spending is deducted. Researchers observed that the attacker submitted a crafted signature bundle that granted admin rights on the individual escrow accounts, allowing the withdrawal of funds from each user’s contract. The exploit did not target a single pooled treasury but drained the accounts one by one.

Impact on AVICI Token

Following the exploit, the AVICI token fell roughly 40%, trading around $0.24. The price drop reflects the loss of an amount close to 20% of the token’s market capitalization.

Response from Avici

Avici confirmed awareness of an issue affecting card balance withdrawals and said it is monitoring the situation and working with partners to resolve it. No detailed post‑mortem or timeline for remediation has been provided.

Broader Context

Similar incidents on Solana, such as a governance attack that emptied a BONK DAO treasury, have shown that exploits targeting privileged contract paths can lead to rapid token devaluation. The Avici case underscores the risks associated with on‑chain escrow mechanisms that rely on user‑controlled keys.