.jpg)
One signature counted as two
The outdated Rain contract required two independent authorizations before allowing certain account actions, using Solana's Ed25519 verification instructions to confirm signatures. According to Blockaid's analysis, the attacker manipulated the second verification instruction so its signature, public key and message offsets pointed back to information contained in the first instruction.
The vulnerable contract therefore accepted one attacker-controlled signature as two independent approvals, bypassing the authorization requirement without permission from the accounts' owners. The attacker then used an AddCollateralAdmin instruction to grant itself administrative privileges over individual accounts before calling WithdrawCollateralAsset to transfer USDC and USDT out.
Blockaid recorded 2,945 administrator additions and 5,288 withdrawal calls, identifying 8,233 core exploit transactions over approximately two hours and 29 minutes. The first two successful withdrawals occurred three seconds apart, indicating the attacker had prepared an automated system for targeting multiple accounts. Because the exploit occurred at the contract level, phishing protections and malicious-signature warnings would not have prevented the withdrawals — customers never authorized the transactions.
Funds laundered through Tornado Cash
The withdrawn stablecoins accumulated in one Solana wallet before being exchanged for SOL through decentralized trading platforms. Blockaid traced the proceeds from Solana to Ethereum through the deBridge cross-chain protocol, with approximately 455.9 ETH entering Tornado Cash within a 29-minute window. The mixer permits withdrawals to addresses not publicly connected to the sending wallets, making subsequent movements harder to trace, and the stolen funds had not been recovered.
Blockaid connected two Ethereum addresses to the initial financing of the attacker's Solana activity. Neither Rain nor law enforcement has publicly identified the people controlling those addresses. The incident adds to a costly year: crypto security failures caused approximately $1.1 billion in losses during the first half of 2026, according to Blockaid research, and application-level weaknesses have hit protocols of every size.
Shared infrastructure, shared risk
Rain provides infrastructure that lets crypto companies issue cards funded with stablecoins, so the security of deposited funds depends on the provider's code and authorization controls. Blockaid identified four deployments containing code with the same opcode hash as the vulnerable contract, with at least two drained and the other two carrying the same flaw without confirmed losses.
Rain said its monitoring systems discovered the vulnerability affecting a "small number of programs" using the outdated contract version, and that it upgraded every program still running it. The company has not published a complete technical report identifying every affected deployment or explaining why some programs continued using the older version — questions that matter for any infrastructure provider whose code underpins many customer-facing products.
Customers made whole, questions remain
Avici said it refunded all affected customers and provided 10% cashback following the incident. Tria said each affected customer was being reimbursed. The two disclosures account for more than $932,800 of the estimated losses, and both neobanks moved quickly to restore trust.
The episode is a reminder that contract-level exploits sit outside user control: the blockchain continued processing transactions normally while application code failed. As crypto thefts grow more aggressive across every vector, infrastructure audits and upgrade discipline are becoming as important as the card products built on top of them.
