Avici, a next-generation banking platform operating within the Solana ecosystem, has faced a serious security incident. According to on-chain data, the attacker, using only $190 in initial capital, stole approximately $670,000 worth of assets from user accounts. Following the incident, the price of the AVICI token dropped by over 45%.
According to initial reports from SolanaFloor, over $600,000 in funds were withdrawn from Avici users’ accounts without authorization. Avici had previously stated that an anomaly had been detected regarding the withdrawal of bank card balances from the platform and that it was investigating the matter with its partners. The platform later confirmed that the incident stemmed from a security breach.
On-chain analysis revealed the attack was launched at a relatively low cost. The wallet used in the attack was created today at 5:40 PM and funded with approximately $190 worth of USDC bridged from the Ethereum network to Solana. This amount is believed to have been primarily used to cover transaction fees.
The attack reportedly began around 16:49 UTC and continued for thousands of transactions. An investigation revealed that the attacker’s wallet processed over 8,857 transactions.
Attacker Gained Control Over 1,100 Accounts
According to technical analyses, the attack was rooted in an authorization flaw in Avici’s smart contracts. The attacker reportedly called the AddCollateralAdmin function by sending a specific signature packet, thereby identifying themselves as an administrator in users’ collateral accounts.
Because the second signature verification was incorrectly routed to the first instruction, the Solana network accepted the attacker’s own signature as valid a second time. This allowed the program to add an administrator key to the system that it should not have accepted under normal circumstances.
It was stated that thanks to this vulnerability, the attacker gained administrative privileges over more than 1,100 collateral accounts and then began withdrawing funds from these accounts.
The study indicated that the median amount stolen per account in the examined transactions was approximately $24, while the largest single loss in the sample was $5,268.
Between 6:19 PM and 6:34 PM, an initial large group of funds, approximately $576,000, was reportedly moved from the attacker’s wallet to other addresses, after which new funds continued to flow into the attacker’s address. The total loss is estimated to have subsequently reached approximately $670,000.
Initial investigations indicate that the attack did not stem from the compromise of Avici’s program upgrade key. It was noted that the program was neither modified nor updated with a new version, and the upgrade key had not been used since March 2025.
Therefore, it is believed that the incident stemmed directly from an authorization error in the smart contract, rather than a stolen deploy or upgrade key.
On the other hand, claims have surfaced on social media that the attack involved emptying Avici’s central treasury. However, on-chain data does not support this claim. According to current findings, the funds were withdrawn from individual users’ accounts, not from a single treasury account.
Following the security incident, selling pressure on the AVICI token accelerated, and its price quickly dropped by over 45%.
*This is not investment advice.
