An attacker drained over $653,000 from card collateral vaults at Avici, a Solana neobank whose own documentation promised that only a user’s wallet could ever move that money.

The token Avici (AVICI) has since fallen by about 40% to $0.24. The sum taken equals close to a fifth of its entire market value.

What the Avici Exploit Broke

Avici sells a Visa credit card backed by USDC. Users lock the stablecoin in a smart contract, and spending draws it down. Third National issues the card, not Avici.

“Only user’s wallet can withdraw funds from escrow contract after deducting the spends,” the company’s documentation states, indicating who holds the keys.

On Friday, the vaults emptied anyway, with a live tracker counting $653,548 pulled out as of this writing

Self-custody set out who could not take the money. It did not remove every privileged path written into the program itself. That gap is where the funds went.

On-chain researchers say the attacker submitted a crafted signature bundle, made itself an admin on the escrow accounts, then withdrew. Avici has not confirmed that method.

Follow us on X to get the latest news as it happens

Why This Is Not a Treasury Hack

Each customer holds a separate escrow contract. So the money was left account by account. There was no single pot to empty.

It suggests a familiar pattern, such as when a Solana governance attack took $20 million from one BONK DAO treasury in a single stroke.

Associated tokens rarely shrug such incidents off, which is why the AVICI token fell almost 40%. In the same way, a bridge breach sent Midnight’s token to a record low in July.

Avici has said only that it is aware of an issue affecting card balance withdrawals. No post-mortem has followed.

The company has not said whether the remaining vaults can still be called, or whether card settlement with Third National is affected.

Source: BeInCrypto