An ongoing attack against Solana-based crypto card platform Avici has reportedly drained more than $1 million from user collateral accounts while sending its AVICI token to an all-time low.
Key Takeaways
Attacker held 10,005 SOL worth about $1.07 million plus $11,600 in stablecoins
Three-step process added admin access then withdrew collateral from user accounts
AVICI token fell 49.4% in 24 hours to a record low of $0.2175
125 sending accounts identified with transfers ranging from 9 USDC to over 26,000 USDT
Avici Attacker Adds Administrators Before Withdrawals
The suspected attacker collected 10,005.03 SOL, worth about $1.07 million at 18:58 UTC, along with approximately $11,600 in USDC and USDT. The wallet received initial funding through deBridge at 13:40 UTC, when 1.79 SOL arrived from another network. After remaining inactive for about three hours, the address made its first call involving Avici's programs at 16:49:48 UTC.
Transaction logs showed the same three-step process across affected accounts. First, the wallet called SubmitSignatures through Avici's authorization program. Next, the attacker called AddCollateralAdmin on Avici's collateral program, registering an additional administrator for the user's account. A final WithdrawCollateralAsset call then transferred collateral to an account controlled by the attacker. In one reviewed transaction, the withdrawal moved 2,346.77 USDT from a user's collateral account. This connects to the broader Solana security landscape covered in the CCC exploit on BSC and CoinGecko's $3.63B crypto hacks report.
Avici Confirms Card Withdrawal Issue
Avici acknowledged the incident in an X post published about one hour and 53 minutes after the first reported transaction involving its programs. The company said it was working directly with relevant partners and would provide updates. Avici did not call the incident an exploit, confirm how much had been taken, or state how many customers were affected. The attacker signed 14,672 transactions, of which 2,344 failed. SOL holdings increased by about 2,595 tokens, worth approximately $277,000, during an 11-minute period. Anonymous on-chain analyst STACC created a live tracker identifying 125 sending accounts.
Attack Challenges Avici's Self-Custody Claims
Avici describes its product as a self-custodial wallet connected to a secured Visa credit card. Under the card model, customers deposit crypto into collateral accounts and receive a corresponding credit limit. The reported ability to add another administrator and remove unspent collateral raises questions about how Avici's authorization controls enforce its advertised self-custody model. Both Avici authorization and collateral programs were upgradeable and shared the same upgrade authority, a standard Solana account rather than a multisig.
Security findings reported in July showed that compromised keys, signers and infrastructure accounted for 88.3% of roughly $764 million stolen during the second quarter of 2026. The Hacken report found that only 4% of tracked projects combined audits, active bug bounties, and third-party monitoring. This connects to the Moonwell MAMO exploit and broader DeFi security concerns.
AVICI Falls 49% to All-Time Low
AVICI dropped 49.4% over 24 hours to $0.2175 as reports of the withdrawals spread, according to CoinGecko data. The selloff reduced the token's market capitalization to approximately $2.84 million on $656,543 in 24-hour volume. CoinGecko lists AVICI's record high at $7.56, reached on Nov. 26, 2025, leaving the token approximately 97% below that peak. Avici Inc. is a Delaware corporation based in San Francisco that raised $3.5 million through a capped MetaDAO token sale in October 2025.
