Table of Contents
The Exploit Sequence
An outdated Rain card contract drained $1.1 million across multiple Solana-based neobanks between August 27 and August 29, 2026. The vulnerability affected 1,685 Avici users ($500,800 in losses) and 636 Tria users ($430,000 in losses). Avici's native AVICI token fell 49% following the disclosure.
The attack mechanism was straightforward. The perpetrator submitted repeated signed authorizations that inserted them as administrators on individual card-collateral wallets. Once granted admin access, they extracted funds directly from the on-chain vaults backing each user's card balance.
Rain identified the vulnerability in what it described as an outdated contract version. The company upgraded every program running that version and reported no further unauthorized activity as of August 29.
Shared Infrastructure, Distributed Liability
This was not a single-program failure. Rain provides card infrastructure as a service to multiple neobanks. The outdated contract version was deployed across several programs simultaneously, creating a shared attack surface.
When the exploit succeeded against one implementation, the same vulnerability existed across all programs using that contract version. The attacker did not need to find separate bugs in Avici's code and Tria's code. They found one bug in Rain's shared contract layer.
Both affected neobanks have committed to full reimbursement. Avici restored affected balances with an additional 10% cashback. Tria pledged to repay users in full. These are correct responses, but they shift attention away from the structural question: who owns the security burden when card products run on shared infrastructure?
The Admin Privilege Escalation
The vulnerability allowed privilege escalation to admin status on individual wallets. That design choice is worth examining. Card-collateral wallets require some form of programmatic control to authorize transactions, but granting full admin rights through a signature mechanism creates a single point of failure.
If an attacker can forge or replay authorizations, they gain complete control over user funds. The contract did not appear to include rate limiting, multi-sig requirements, or time-delayed admin changes that would have made exploitation more difficult.
Token Impact as Market Signal
The 49% drop in AVICI token value occurred within hours of public disclosure of the exploit. Tria does not have a native token, so no direct comparison is available.
The token crash is informative. Avici committed to full reimbursement plus 10% cashback, which mitigates direct user harm. The market repriced the token anyway. That suggests the market is pricing either reputational damage, concern about additional vulnerabilities, or doubt about the sustainability of a business model that absorbs $500,800 in unexpected losses.
The perpetrator reportedly turned a $190 initial outlay into $670,000 in extracted value, according to on-chain analysis. That return profile will attract attention from other attackers reviewing similar infrastructure.
What the Data Can't Tell You Yet
Rain described the vulnerable contract as "outdated" but has not published a detailed post-mortem explaining when the contract was deprecated, why it remained in production use, or what specific code change introduced the vulnerability.
We do not know whether the exploit involved signature replay, a flaw in authorization logic, or a previously unknown vector. Without that technical detail, it is difficult to assess whether other card infrastructure providers face similar risks.
The claim that "no further unauthorized activity" occurred after the upgrade is based on monitoring as of August 29. A sophisticated attacker might pause activity after an upgrade to avoid detection while identifying alternate vectors.
What This Rules Out
This was not a private key compromise. Users did not sign malicious transactions. The exploit operated at the contract level, inserting the attacker as an admin without requiring individual wallet access.
It was not a cross-chain bridge failure. The funds remained on Solana throughout the attack. The vulnerability was specific to the card-collateral contract architecture.
It was not a centralized custodian failure. The funds were held in on-chain contracts, not in Rain's or the neobanks' custody. The attack exploited the programmatic logic governing those contracts.
The Takeaway
Card products that hold funds in on-chain contracts introduce a new dependency: the security of the contract becomes the security of the card balance. When multiple programs share infrastructure from a single provider, a vulnerability in one contract propagates across all dependent programs simultaneously. Watch for Rain's technical post-mortem. If it does not appear within 30 days, that absence is itself a signal about transparency practices in shared infrastructure providers.
Frequently Asked Questions
How did the Solana card exploit work?
The attacker exploited a vulnerability in an outdated Rain card contract by submitting repeated signed authorizations. This allowed them to insert themselves as administrators on individual card-collateral wallets. Once granted admin access, they extracted funds directly from on-chain vaults backing user card balances. The attack affected multiple neobanks simultaneously because they shared the same vulnerable contract infrastructure.
Which neobanks were affected by the Rain card exploit?
Avici and Tria were the two publicly named neobanks affected by the exploit. Avici lost $500,800 across 1,685 users, while Tria reported losses exceeding $430,000 affecting 636 users. Rain indicated a small number of other programs using the outdated contract version were also impacted but did not name them publicly. Total losses across all affected programs reached approximately $1.1 million.
Will users affected by the Solana card hack be reimbursed?
Yes. Both affected neobanks have committed to full reimbursement. Avici confirmed that all affected balances were restored in full, with an additional 10% cashback on withdrawn amounts. Tria pledged to repay users in full. These reimbursements shift the financial burden to the neobanks themselves rather than leaving users to absorb losses from the infrastructure vulnerability.
Why did the AVICI token crash 49% after the exploit?
The AVICI token fell 49% within hours of public disclosure despite Avici's commitment to full reimbursement plus 10% cashback. The market appears to be pricing either reputational damage, concern about additional vulnerabilities in Avici's infrastructure, or doubt about the financial sustainability of a business model that absorbs unexpected losses exceeding $500,000. Token holders may also be concerned about dilution if new tokens are issued to cover reimbursement costs.
What does this exploit reveal about crypto card security risks?
The exploit highlights a structural risk in card products that hold funds in on-chain contracts. When multiple programs share infrastructure from a single provider, a vulnerability in one contract propagates across all dependent programs simultaneously. The attack also revealed inadequate access controls, as the contract allowed privilege escalation to admin status without apparent rate limiting, multi-sig requirements, or time-delayed admin changes that could have prevented or slowed the exploit.
