An attacker withdrew about $1.1 million on August 30, 2026, from the accounts that back spending on payment cards issued on the infrastructure of Rain, which runs card programs backed by digital assets on the Solana blockchain. Two programs have disclosed their losses: Avici, $500,800 across 1,685 users, and Tria, more than $430,000 across 636 users. The rest of the total falls on other programs that Rain has not named.
The flaw sat in an outdated version of Rain’s card contract that several programs were still running, even though a current version already existed. Users’ self-custodied wallets were not affected.
Only the collateral behind the cards was hit
The attack targeted the collateral accounts: the balances locked up to guarantee card spending. Those accounts are separate from the self-custodied wallets users hold, which were untouched. That line defines the scope of the incident. The money taken was the money standing behind the cards, not the assets cardholders keep under their own control.
The attacker replayed signed authorizations, one account at a time
The attacker repeatedly submitted signed authorizations that registered it as administrator of individual collateral accounts, then withdrew each balance. Because the control it gained applied to one account at a time, the attack moved account by account rather than draining a single shared reserve in one go.
- Signed authorizations submitted to the card contract again and again
- The attacker registered as administrator of a collateral account
- The account’s balance withdrawn, then on to the next account
Stolen funds went through Tornado Cash
The stolen stablecoins were swapped for SOL, bridged to Ethereum, and run through the Tornado Cash mixer. The mixer breaks the public on-chain trail. Identifying the final recipient now depends on evidence from outside the blockchain, such as an off-ramp into fiat currency or a legal request to an intermediary.
Avici and Tria promise refunds but give no timeline
Avici has pledged to refund affected balances in full and has filed a report with the FBI’s Internet Crime Complaint Center (IC3). Tria has also pledged to make its customers whole. Neither company has said when the refunds will be paid.
The AVICI token fell 49%, from a 24-hour high of $0.43 to a low of $0.217, before recovering to around $0.378. Tria’s token dropped more than 10%.
A second card program disruption in a month
On August 2, 2026, the collapse of Paris-based issuer Kulipa shut down 120,000 stablecoin cards overnight. The causes differ: an insolvency in one case, a vulnerable contract in the other. The dependency is the same. A card program runs on infrastructure it does not operate, and it inherits that infrastructure’s flaws without seeing them.
Two disclosures are still needed to gauge the full reach of the incident: the refund timeline both programs have promised, and a list of the programs that were running the outdated contract. Rain has not said how long that version had been in production.