Avici, a crypto neobank, has pledged to fully refund users affected by a recent security breach that exposed $500,859 in card balances. The firm announced on August 28 that 1,685 users were impacted by the incident.
Full refunds assured
In a statement, Avici confirmed that every affected user will have their card balance refunded in full. The company said it remains in close contact with its card-issuing and security partners and is monitoring remediation efforts closely.
Rain, Avici's card-issuing partner, identified the vulnerability as a bug affecting a small number of programs using an outdated version of their Solana contracts. Rain has implemented fixes to resolve the issue.
Scope of the breach
Avici wallets, which are self-custodial, were not affected by the exploit. The breach only impacted card balances held in separate Solana contracts managed by Rain. When users top up their cards, funds are transferred into these isolated contract wallets, keeping them distinct from the main wallet holdings.
Broader implications for crypto cards
The incident has drawn attention to security risks across the crypto card sector. Rain infrastructure powers most crypto card offerings, and crypto card transaction volumes reached a record $625 million in August, led by Rain. This market concentration raises questions about potential systemic risks if similar vulnerabilities were discovered at larger scales.
