Avici (Solana card vaults) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Wallet software or provider |
| Loss | $500,859Published estimates range $500,859 to $1,100,000Price at time of incident |
| Method | Access control flawAdministrative collateral functions on an outdated card contract were callable by the attacker, who added and withdrew collateral against balances the company had said only users could move |
| Chains | Solana |
| Outcome | Users reimbursed |
What happened
Avici, a Solana-based neobank, had its card vaults drained on 28 August 2026 through an outdated card smart contract. The attacker reached administrative collateral functions — signature submission, adding collateral as admin, and withdrawing a collateral asset — and moved funds the company had told users only they themselves could touch.
Avici's own confirmed card-balance loss is $500,859.22, and that is the figure recorded. Researchers following the laundering trail on-chain arrived at a larger total, variously reported between roughly $1m and $1.1m, and the high end of the range reflects that; intermediate reports of about $600,000 and $650,000 fall inside it. The spread is a genuine disagreement about how much left, not two ways of counting, so it is recorded as a range rather than resolved by preference.
On 29 August the company committed to reimbursing all 1,685 affected users in full, with credits processed automatically over the following weeks. The AVICI token fell roughly 40% to about $0.24 on the news, and by some measures closer to half its value.
The attackers moved on the same day to Ajna v2, which is recorded separately.
Sources
- CryptopolitanSecondary · retrieved 2026-08-31
- Yahoo FinanceSecondary · retrieved 2026-08-31
- CryptopolitanSecondary · retrieved 2026-08-31
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Avici (Solana card vaults) hack — August 2026", iTokenly, accessed 2026-08-31, https://itokenly.com/hacks/avici-card-vaultshttps://itokenly.com/hacks/avici-card-vaultsPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.