Solana Neobank Avici Hacked for $650,000. Token Crashes 40%
An attacker drained over $653,000 from card collateral vaults at Avici, a Solana neobank whose own documentation promised that only a user's wallet could ever move that money.
The token Avici (AVICI) has since fallen by about 40% to $0.24. The sum taken equals close to a fifth of its entire market value.
What the Avici Exploit Broke
Avici sells a Visa credit card backed by USDC. Users lock the stablecoin in a smart contract, and spending draws it down. Third National issues the card, not Avici.
"Only user's wallet can withdraw funds from escrow contract after deducting the spends," the company's documentation states, indicating who holds the keys.
On Friday, the vaults emptied anyway, with a live tracker counting $653,548 pulled out as of this writing
Self-custody set out who could not take the money. It did not remove every privileged path written into the program itself. That gap is where the funds went.
On-chain researchers say the attacker submitted a crafted signature bundle, made itself an admin on the escrow accounts, then withdrew. Avici has not confirmed that method.
โฆ Continue reading the full article at the original source below.
