On 30 August 2026, about $1.1 million was withdrawn from the accounts that back card spending on the infrastructure of Rain, a provider of card programmes collateralised by digital assets on the Solana chain. Two programmes published their losses: Avici, $500,800 across 1,685 users, and Tria, more than $430,000 across 636 users. The gap to the total covers other programmes, which Rain has not named.
What was drained, and what was not
The attack hit the collateral accounts, the balances locked to back card spending. Those accounts are separate from the users' self-custodied wallets, which were not touched. The distinction sets the scope of the incident: the money that was taken is the money backing the spend, not the holdings that cardholders keep themselves.
The mechanism: a signed authorisation submitted again and again
The attacker repeatedly submitted signed authorisations to register itself as the administrator of collateral accounts, one account at a time, then withdrew the balances. The flaw sat in a stale version of Rain's card contract that several programmes were still running. The control it granted applied to individual accounts, which is why the attack ran account by account rather than as a single draw on a shared reserve.
- Repeated submission of signed authorisations to the card contract
- Registration of the attacker as administrator of one collateral account
- Withdrawal of that account's balance, then on to the next account
Where the money went
The stablecoins were swapped for SOL, bridged to Ethereum, then run through the Tornado Cash mixer. A mixer breaks the public trail on the chain. Identifying the final recipient then depends on evidence from outside the chain, such as an exit point into official currency or a request to an intermediary.
What the two programmes have said
Avici has committed to reimbursing the affected balances in full and has filed a report with the FBI's Internet Crime Complaint Center. Tria has also committed to refunding its customers. Neither company has published a reimbursement timetable.
The AVICI token fell from a 24-hour high of $0.43 to a low of $0.217, a drop of 49%, before recovering to around $0.378. Tria's token fell by more than 10%.
The second card programme cut off in a month
On 2 August 2026, the failure of the Paris issuer Kulipa switched off 120,000 stablecoin cards overnight. The causes differ, an insolvency in one case and a vulnerable contract in the other. The dependency is the same: a card programme runs on infrastructure it does not operate, and inherits flaws it cannot see.
Two things are still to be published before the reach of the incident can be measured: the reimbursement timetable both programmes have promised, and the list of programmes that were running the stale contract. Rain has not said how long that version had been in production.