Security Breach at Avici
In a significant security breach impacting the Solana-based cryptocurrency card service Avici, over $1 million has been siphoned from user collateral accounts, leading to a dramatic decline in the value of its AVICI token. The incident, which is still under investigation, saw the perpetrator reportedly purloining 10,005.03 SOL, approximately $1.07 million at the time, along with around $11,600 in stablecoins USDC and USDT.
Details of the Attack
An analysis of Solana’s transaction logs shed light on the unfolding attack, which commenced shortly after the initial fund transfer to the attacker’s wallet at 13:40 UTC when 1.79 SOL was deposited through the deBridge network.
For nearly three hours, the wallet remained dormant until it began interacting with Avici’s programs at 16:49:48 UTC, executing a systematic three-step strategy that exploited vulnerabilities in the platform’s collateral management system. The counterfeit transactions involved calling specific operations through Avici’s authorization program, such as “SubmitSignatures” and “AddCollateralAdmin”, which allowed the attacker to gain heightened privileges and ultimately withdraw user funds.
In one notable instance, 2,346.77 USDT was withdrawn from a victim’s account, with the assailant later exchanging some stablecoins for SOL, enhancing their illicit gains.
Transaction Analysis
As of the incident analysis, the wallet was reported to have executed 14,672 transactions, with a failure rate of 16% for about 2,344 transactions. Continuous monitoring later unveiled that the attacker incrementally increased their holdings, obtaining roughly 2,595 SOL within a mere eleven minutes. A live tracking tool established by an anonymous analyst, known as STACC, indicated that the attacker had exploited 125 distinct user accounts, with transfers ranging from minimal amounts to staggering sums of over 26,000 USDT.
Avici’s Response
While Avici has acknowledged the issue via a post on social media platform X, it has not provided a detailed explanation regarding how the attacker gained entry or the extent of customer losses. Their initial response indicated a focus on monitoring and remedial action without explicitly labeling the incident as an exploit or confirming if user funds would be compensated.
Speculation surrounds whether operational lapses or compromised signing keys may have enabled the intrusion, as users began reporting missing balances even before Avici released its statement.
Impact on AVICI Token
The distressing event centers on Avici’s card collateral and authorization operations, rather than identifying any underlying vulnerabilities within the Solana blockchain itself. Both programs are designed to be upgradable and shared a singular upgrade authority, which has raised questions about the security framework behind the operations.
It’s essential to clarify that a self-custodial wallet like Avici promises that users maintain control of their assets, putting the onus on the company to elucidate why unauthorized withdrawals were possible.
Compounding these issues, the fall of Avici’s token value has been swift – plunging nearly 50% and hitting an all-time low of approximately $0.2175 within a 24-hour window as word of the breach circulated. Trading logs reveal that the total market cap shrunk to around $2.84 million, with trading volumes reaching about $656,543 during this frenzied period. CoinGecko data highlighted the stark contrast to AVICI’s previous peak valuation of $7.56 witnessed in late 2025.
Future Considerations
In the wake of this incident, questions remain regarding the status of Avici’s programs, whether further attacks are a threat, and how the company plans to restore user confidence while ensuring that lessons are learned to bolster security protocols. As cryptocurrency services increasingly come under scrutiny for operational risk management, Avici’s situation illustrates a pressing need for enhanced security measures to protect consumer assets and data.
