Avici attack drains over $1M from Solana users

An ongoing attack against Solana-based crypto card platform Avici has reportedly drained more than $1 million from user collateral accounts while sending its AVICI token to an all-time low. Summary The suspected attacker held 10,005 SOL and about $11,600 in stablecoins at one checkpoint. On-chain records showed repeated calls that added an administrator before collateral withdrawals. Avici acknowledged a card balance withdrawal issue but did not confirm the reported loss. AVICI fell 49.4% within 24 hours and touched a record low of $0.2175. Avici attacker adds administrators before withdrawals According to reports, the suspected attacker had collected 10,005.03 SOL, worth about $1.07 million at 18:58 UTC, along with approximately $11,600 in USDC and USDT. Its analysis was based on Solana transaction logs and RPC data gathered while the attack was still underway. The wallet received its initial funding through deBridge at 13:40 UTC, when 1.79 SOL arrived from another network. After remaining inactive for about three hours, the address made its first call involving Avici’s programs at 16:49:48 UTC. Transaction logs reviewed by the publication showed the same three-step process across affected accounts. First, the wallet called SubmitSignatures through Avici’s authorization program in a transaction that also used Solana’s Ed25519 signature verification program. You might also like: CCC exploit drains $117K after attacker targets BSC liquidity pool Next, the attacker called AddCollateralAdmin on Avici’s collateral program, registering an additional administrator for the user’s account. A final WithdrawCollateralAsset call then transferred the collateral to an account controlled by the attacker. In one reviewed transaction, the withdrawal instruction moved 2,346.77 USDT from a user’s collateral account. The attacker also converted some of the collected stablecoins into SOL, including one swap that returned 209.76 SOL. By the publication’s checkpoint, the wallet had signed 14,672 transactions, of which 2,344 had failed. Its SOL holdings increased by about 2,595 tokens, then worth approximately $277,000, during an 11-minute period. Anonymous on-chain analyst STACC also created a live tracker for the affected transfers. According to figures cited from the tracker, 125 sending accounts had been identified, with individual transfers ranging from approximately 9 USDC to more than 26,000 USDT. Neither Avici nor an independent security company has published a post-mortem identifying how the attacker obtained authorization. Although the transaction sequence shows how funds moved, it does not establish whether the incident resulted from a program flaw, compromised credentials, an exposed signing authority, or another failure. Avici confirms card withdrawal issue Avici acknowledged the incident in an X post published about one hour and 53 minutes after the first reported transaction involving its programs.