Rain Card Infrastructure Hack Hits Avici Neobank; Full Refunds Pledged to Over 1,680 Users

Rain, a crypto card infrastructure provider, said an outdated version of its Solana based smart contracts, which manage users card balances, contained a vulnerability. An attacker repeatedly submitted signed authorizations to insert themselves as an administrator on individual users card collateral wallets and withdraw funds. Avici, a Solana based neobank, said in an update on Friday, 6 Shahrivar 1405 (August 28, 2026), that 1,685 of its users were affected, with total impacted card balances reaching 500,859.20 dollars.

Avici pledged to fully refund every affected user and stressed that the incident was limited to card funding contracts, leaving users self custodial wallets untouched. Rain said it has upgraded every program still running the vulnerable contract version and has observed no further unauthorized activity since. Avici's token fell as much as 49 percent from its 24 hour high after the breach was disclosed. According to crypto news outlets, another neobank called Tria, which uses the same Rain infrastructure, reported that 636 of its users were affected, with losses exceeding 430,000 dollars.