Solana Neobank Avici Loses $650K in Hack as AVICI Token Crashes 27%

Solana based neobank Avici has suffered an exploit that drained more than $653,000 from customer card collateral vaults, sending its AVICI token down roughly 27%.

The attack targeted vaults used to back Avici's USDC-based Visa credit cards. The stolen amount represents nearly one-fifth of the project's market value, adding further pressure to the token after the exploit.

Avici Card Vaults Drained

Avici allows users to deposit USDC into smart contract escrow accounts that back spending on its Visa card.

The company's documentation states that only a user's wallet should be able to withdraw funds from an escrow contract after card spending has been deducted.

Despite that protection, more than $653,000 was reportedly removed from the vaults on Friday.

On-chain researchers suggested that the attacker may have used a crafted signature bundle to gain administrative control over escrow accounts before withdrawing the funds. Avici has not confirmed that specific attack method.

Why the Exploit Is Different From a Treasury Hack

The incident does not appear to involve a single centralized treasury containing all customer funds.

Each Avici customer uses a separate escrow contract, meaning the affected USDC was distributed across individual accounts rather than sitting in one shared pool.

That structure makes the incident particularly significant because the exploit appears to have bypassed the permissions intended to protect individual customer balances.

Avici's documentation effectively established which wallet should have control over withdrawals, but additional privileged functionality in the underlying contracts may have created another route to the funds.

AVICI Token Falls 27%

The security incident quickly spilled over into the project's token market.

AVICI fell approximately 27% to $0.30, with the stolen amount representing close to 20% of the token's entire market capitalization.

Sharp token declines are common after DeFi and crypto infrastructure exploits because traders immediately reassess both the security of the project and the likelihood of recovering affected funds.

The price reaction can also make it harder for a project to finance remediation efforts or maintain confidence among users.

Avici Has Not Released a Full Post-Mortem

Avici has acknowledged an issue affecting card balance withdrawals but has not yet published a detailed post-mortem explaining how the attacker gained access.

The company has also not publicly clarified whether the remaining vaults can still be accessed by an attacker or whether card settlement with Third National, the institution that issues Avici's Visa card, has been affected.

Those details will be important in determining the full scope of the incident.

Until Avici completes its investigation and secures the affected contracts, users should treat the remaining collateral as potentially exposed.

What Happens Next?

The immediate priority is identifying the vulnerability, securing remaining vaults and determining how much customer collateral was affected.

Avici will also need to explain how a system designed around user-controlled withdrawals allowed an attacker to obtain administrative privileges.

For AVICI holders, the token's 27% decline shows how quickly a smart contract exploit can translate into market losses.

The incident is another reminder that self custody claims do not automatically eliminate smart contract risk. The security of a DeFi product ultimately depends not only on who holds the keys, but also on the permissions and logic embedded in the contracts controlling those funds.