Flawed Rain Solana Contract Drained $1.1M From Avici and Tria Card Users

An attacker exploited an outdated Solana smart contract in Rain’s crypto-card payment infrastructure, replaying signed authorizations to appoint themselves collateral-account administrator and withdraw card balances. The campaign stole about $1.1 million across several card programs, including more than $500,000 from 1,685 Avici users and over $430,000 from 636 Tria users. On-chain records showed repeated use of the SubmitSignatures, AddCollateralAdmin, and WithdrawCollateralAsset instructions; one observed wallet accumulated roughly 10,005 SOL, alongside USDC and USDT.

The attacker exchanged stolen stablecoins for SOL, bridged funds to Ethereum, and used Tornado Cash to obscure their trail. Rain upgraded all programs using the vulnerable contract version, while Avici and Tria said customers would be fully reimbursed; Avici also filed a complaint with the FBI’s IC3. Avici initially acknowledged a card-balance withdrawal issue nearly two hours after the first drain, and its AVICI token fell about 49% as the incident emerged.