Key Takeaways
- • A $1.1 million exploit targeting an outdated Rain card contract on Solana drained funds from multiple crypto neobanks, with Avici users losing $500,800 across 1,685 accounts and Tria users losing $430,000 across 636 accounts.
- • Avici's AVICI token crashed 49% from a 24-hour high of $0.43 to a record low of $0.217, later recovering to approximately $0.305–$0.378, while Tria's token declined over 10% during the incident.
- • The vulnerability was confined to card-funding contracts holding customer deposits, not self-custodial wallets on Solana or Ethereum-compatible networks, limiting the scope of the compromise.
- • Both Avici and Tria committed to full refunds for affected users, with Rain identifying and patching the outdated contract version across all impacted programs and reporting no further unauthorized activity.
- • The incident highlights infrastructure risks in the emerging crypto neobank sector, where third-party service providers like Rain (a Visa principal member handling stablecoin card infrastructure) create single points of failure.
Summary
On August 28, 2026, a security vulnerability in an outdated smart contract operated by Rain, a Visa principal member providing stablecoin card infrastructure, resulted in a $1.1 million drain across multiple Solana-based programs. The exploit disproportionately impacted two crypto neobanks: Avici, which lost $500,800 from 1,685 users, and Tria, which suffered $430,000 in losses affecting 636 users. The vulnerability existed in Rain's card-funding contract, a system designed to hold customer deposits after account top-ups before funds are transferred to Visa-integrated credit cards.
The market impact was immediate and severe. Avici's native token, AVICI, plummeted 49% from its 24-hour high of $0.43 to a record low of $0.217 before partially recovering to $0.305–$0.378. Tria's token fell more than 10% during the incident. The sharp price movement reflects investor concerns about custodial security practices and operational resilience in the nascent crypto neobank ecosystem.
Both companies moved swiftly to contain damage and restore confidence. Avici confirmed that the breach was strictly limited to card-funding contracts and did not compromise self-custodial wallets on Solana or Ethereum-compatible networks, a critical distinction for users concerned about total asset exposure. The company pledged full refunds for all affected card balances. Tria issued a similar commitment to reimburse all impacted users in full.
Rain identified the vulnerability through its monitoring systems and upgraded every program running the outdated contract version, reporting no further unauthorized activity post-remediation. The infrastructure arrangement reveals structural vulnerability in the crypto neobank model: Avici relies on Third National as the card issuer and Rain as the underlying infrastructure provider, creating dependency on third-party security protocols. This incident underscores the operational and reputational risks embedded in outsourced critical infrastructure within the fintech-crypto intersection.
The market impact was immediate and severe. Avici's native token, AVICI, plummeted 49% from its 24-hour high of $0.43 to a record low of $0.217 before partially recovering to $0.305–$0.378. Tria's token fell more than 10% during the incident. The sharp price movement reflects investor concerns about custodial security practices and operational resilience in the nascent crypto neobank ecosystem.
Both companies moved swiftly to contain damage and restore confidence. Avici confirmed that the breach was strictly limited to card-funding contracts and did not compromise self-custodial wallets on Solana or Ethereum-compatible networks, a critical distinction for users concerned about total asset exposure. The company pledged full refunds for all affected card balances. Tria issued a similar commitment to reimburse all impacted users in full.
Rain identified the vulnerability through its monitoring systems and upgraded every program running the outdated contract version, reporting no further unauthorized activity post-remediation. The infrastructure arrangement reveals structural vulnerability in the crypto neobank model: Avici relies on Third National as the card issuer and Rain as the underlying infrastructure provider, creating dependency on third-party security protocols. This incident underscores the operational and reputational risks embedded in outsourced critical infrastructure within the fintech-crypto intersection.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.