An attacker drained more than $1 million from users of Avici, a Solana-based neobank that issues Visa cards backed by cryptocurrency, in an ongoing security breach that compromised the platform's self-custodial authorization layer. The exploit targeted customer collateral accounts through fraudulent administrator registrations.
The breach affected Avici's self-custodial architecture, which holds user balances in onchain accounts authorized through passkeys rather than traditional seed phrases. The attacker bypassed this authorization mechanism by calling an instruction that registered a new administrator on targeted user collateral accounts, then withdrew the full balance from each compromised account, according to The Defiant.
How Did the Attacker Drain Avici Funds?
The attacker exploited Avici's account authorization system by registering fraudulent administrators on user collateral accounts. Once the malicious administrator was added, the attacker executed withdrawal instructions to drain the accounts. The attack wallet, identified as FVNFzq[…]QnCEj, held 10,005.03 SOL worth approximately $1.07 million at 18:58 UTC, plus roughly $11,600 in USDC and USDT. The wallet's SOL balance grew by approximately 2,595 tokens — about $277,000 — in the 11 minutes prior to that timestamp.
Avici markets its card product as self-custodial, differentiating itself from centralized crypto card providers by maintaining user funds in onchain accounts that customers control through passkey authentication. This architecture eliminates the need for seed phrase management but introduces a different attack surface through the authorization layer that manages account permissions.
What Has Avici Said About the Breach?
Avici acknowledged the attack in a post at 18:42 UTC, though the company's statement was incomplete in the source material. The platform had not issued a full public disclosure detailing the scope of affected users, the technical vulnerability exploited, or remediation steps by press time. The live nature of the attack, with funds continuing to flow to the attacker's wallet in real time, suggests the vulnerability remained unpatched during the initial hours of the breach.
What Should Avici Users Do Next?
Users with active Avici accounts should monitor their balances immediately and prepare for potential account restrictions as the platform responds to the breach. The ongoing nature of the exploit indicates that additional users may be at risk until Avici disables the vulnerable authorization mechanism. Affected users should document their account balances and transaction history for potential recovery processes.
The incident marks a significant security failure for Solana's growing neobanking ecosystem, where onchain custody models compete with traditional custodial approaches. The attack's success despite passkey authentication raises questions about the security assumptions underlying self-custodial financial products on Solana.
Metric | Value |
|---|
Total SOL Stolen | 10,005.03 SOL |
USD Value | ~$1.07 million |
Stablecoins Taken | ~$11,600 |
Attack Duration (captured) | 11+ minutes |
Solana Documentation — Account Model
