Tria and Avici Report 2,321 Users Hit by Rain Solana Card…

How Did The Rain Solana Card Exploit Affect Tria Users? Crypto finance platform Tria has reimbursed 636 users who lost a combined $431,945 from card balances after a vulnerability in card issuer Rain’s Solana infrastructure allowed unauthorized withdrawals. Tria said every affected customer received a full refund plus an additional 10%. If applied directly to the affected balance, the extra compensation would amount to roughly $43,200, taking total payments to around $475,000. The incident began on Aug. 28 and affected Solana USDC and USDT that customers had transferred into their Tria card balances. Tria said its main self-custodial wallets were not compromised. “Every affected user has now received their full refund, plus an additional 10% to each user,” Tria said. The company worked with Rain and security partners during the investigation and remediation. Tria’s wallet assets and card balances operate separately. Once customers top up their cards using Solana assets, those funds move into a separate contract supporting the card balance. That contract, rather than the underlying Tria wallet, was affected. Assets held in Tria wallets across Solana, EVM networks and Aptos remained untouched. What Did Rain Change After The Unauthorized Withdrawals? Rain said its monitoring systems identified a vulnerability affecting a small number of programs still operating an outdated version of its Solana contracts. It subsequently upgraded every program using the affected version and said no further unauthorized activity had been observed. The payments infrastructure provider also brought in third-party forensic specialists and said it would work with law enforcement and relevant regulators. Rain has not disclosed total losses across all affected programs or published a complete technical post-mortem. The incident extended beyond Tria. Solana-focused financial app Avici said 1,685 users had $500,859.22 in card balances affected by the same contract issue. Its self-custodial wallets were also untouched. Security firm SlowMist classified the incident as a smart-contract vulnerability and said the affected authorization flow permitted unauthorized administrative access before collateral was withdrawn. Combined disclosures from Tria and Avici put affected balances above $932,000 across 2,321 users. Because Rain has only referred to a small number of affected programs, it remains unclear whether other card providers also suffered losses. Investor Takeaway The incident shows that self-custody can protect a user’s main wallet without eliminating risk after assets are transferred into card infrastructure. The security of a crypto card depends on both the wallet layer and the contracts, issuers and settlement systems used to make those assets spendable. Why Does The Incident Matter Beyond Tria? Rain provides card infrastructure to fintech companies, wallets, neobanks and exchanges, including card issuance, wallets, stablecoin settlement and on- and off-ramps. The company says its infrastructure supports hundreds of businesses and card spending at more than 150 million merchants across over 150 countries.