Fnalysis.
Card With a Leak
A flaw in an outdated crypto card provider let an attacker steal $1.1 million from several neobanks, and crashed one of their tokens 49% in a single day
On August 28, 2026, an attacker exploited a vulnerability in an outdated contract belonging to crypto card provider Rain, used by several neobanks that let people spend crypto with a Visa card. They managed to add themselves as an administrator on users' card-collateral accounts and drain them: they took $500,800 from 1,685 Avici users and another $430,000 from 636 users of neobank Tria, a total of $1.1 million stolen across several Solana platforms.
Avici's own token (AVICI) crashed 49% within hours of the hack becoming public. The stolen money was converted into stablecoins, swapped to SOL, bridged to Ethereum, and ultimately laundered through crypto mixer Tornado Cash. Avici said its self-custodial wallets were unaffected and promised to fully refund every affected user.
Source: CoinDesk →Swiped the card at a rigged terminal, and they cloned the whole bank along with it.