Loading story…
An attacker exploited an outdated Solana smart contract in Rain’s crypto-card payment infrastructure, replaying signed authorizations to appoint themselves collateral-account administrator and withdraw card balances. The campaign stole about $1.1 million across several card programs, including more than $500,000 from 1,685 Avici users and over $430,000 from 636 Tria users. On-chain records showed repeated use of the SubmitSignatures, AddCollateralAdmin, and WithdrawCollateralAsset instructions; one observed wallet accumulated roughly 10,005 SOL, alongside USDC and USDT.
The attacker exchanged stolen stablecoins for SOL, bridged funds to Ethereum, and used Tornado Cash to obscure their trail. Rain upgraded all programs using the vulnerable contract version, while Avici and Tria said customers would be fully reimbursed; Avici also filed a complaint with the FBI’s IC3. Avici initially acknowledged a card-balance withdrawal issue nearly two hours after the first drain, and its AVICI token fell about 49% as the incident emerged.
Track how attackers are adapting to this technology.
10 events from the most recent confirmed update back to the earliest known activity.
AVICI fell roughly 49%, declining from about $0.43 to an all-time low near $0.217 before partially recovering to around $0.378. Tria's token fell by more than 10%.
Transaction analysis found that the attacker swapped stolen stablecoins for SOL, bridged assets to Ethereum, and routed them through the Tornado Cash mixer.
Avici and Tria said they would fully compensate affected customers. Avici also reported filing a complaint with the FBI Internet Crime Complaint Center (IC3).
Avici reported losses exceeding $500,000 affecting 1,685 users, while Tria reported more than $430,000 stolen from 636 users. The incident was assessed as affecting about $1.1 million across multiple Rain-linked card programs.
Rain updated every program running the vulnerable contract version and said it observed no further unauthorized-access incidents after the updates.
Rain's monitoring system identified a vulnerability in an outdated Solana smart contract used by Avici and other crypto-card programs, which enabled unauthorized withdrawals across multiple programs.
By 18:58 UTC, the attacker wallet held 10,005.03 SOL, valued at about $1.07 million, plus approximately $11,600 in USDC and USDT. An on-chain tracker identified 125 distinct sending accounts during its observation period.
At 18:42 UTC, Avici publicly acknowledged an issue affecting card-balance withdrawals and said it was working with relevant partners to resolve it.
At 16:49:48 UTC, the attacker began transacting against Avici contracts, replaying signed authorizations, adding itself as a collateral-account administrator, and withdrawing victim funds.
The wallet later used in the attack was funded with 1.79 SOL bridged through deBridge at 13:40 UTC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Step Finance**, a Solana-based DeFi platform and analytics dashboard, reported a breach in which attackers **compromised devices belonging to company executives** and used that access to drain multiple **treasury wallets**. The incident was detected on **January 31**, with the threat actor described as leveraging a **“well-known attack vector,”** though Step Finance did not publicly disclose the specific technique or attribution. Initial third-party estimates from blockchain analytics firm **CertiK** put the theft at **261,854 SOL (~$28.9M)**, but Step Finance’s internal investigation later assessed total losses at **~$40M**. Step Finance said it has recovered **~$3.7M in Remora assets** and **~$1M in other positions** through partner coordination and **Token22 protections**, temporarily halted some operations to reinforce security, and stated that **Remora Markets is isolated** from the incident with **rTokens remaining 1:1 backed**; users were also advised **not to engage with the `STEP` token** until the investigation concludes.
Jun 29, 2026
Drift Protocol, a Solana-based decentralized exchange, lost roughly **$270 million to $286 million** after attackers seized its Security Council administrative powers and drained core vaults, prompting the platform to suspend deposits and withdrawals and warn users not to add funds. Drift later said the theft was not caused by a smart contract bug or leaked seed phrases, but by a sophisticated operation that abused Solana **durable nonce** transactions and pre-signed multisig approvals to execute malicious governance changes later. Investigators and Drift said the attackers removed withdrawal limits, introduced a fake collateral asset called **`CVT`** or CarbonVote Token, manipulated controls, and rapidly moved assets out of borrow/lend products, vault deposits, and trading funds, cutting the protocol’s total value locked from about **$550 million** to below **$250 million** and sending the **DRIFT** token sharply lower. Subsequent post-mortems described the breach as the culmination of a **months-long social-engineering campaign** in which the threat actors posed as a legitimate quantitative trading firm, built trust through conferences, Telegram chats, integrations, and deposits, and likely compromised contributors through a malicious code repository and a trojanized TestFlight wallet app. Blockchain intelligence firms including **Elliptic** and **TRM Labs** said the laundering patterns, cross-chain bridging from Solana to Ethereum, use of **Tornado Cash**, and other indicators were consistent with **North Korean** tradecraft, while Drift linked the operation with medium confidence to **UNC4736 / AppleJeus / Citrine Sleet**. The fallout widened beyond Drift as critics questioned why more than **$230 million in USDC** moved through Circle’s CCTP bridge without being frozen, Solana launched new security initiatives, and Drift later secured recovery backing including up to **$127.5 million from Tether** as it worked with security firms, exchanges, bridges, and law enforcement to trace and recover funds.
Jun 29, 2026
Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about **$280 million to $285 million** after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s **durable nonce** feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called **CarbonVote Token (`CVT`)**, and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into **USDC** and **SOL**, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.
Jul 1, 2026