Avici exploit hit 1,685 cards, AVICI fell

An exploit in Avici affected 1,685 users, and the AVICI token dropped by nearly 28%. The incident happened because of a vulnerability in a Solana contract for card balances. It hit the cards themselves, not the main wallets.

The Avici team said that self-custodial Solana and EVM wallets were not affected. According to its data, the total amount of lost card balances was $500 859,22. For cardholders, that is the main question. Where exactly were the funds stored?

What exactly was hacked in Avici?

The problem was not in users’ main wallets. The attack targeted the contract where funds were sent after a card top-up. That is where the authorization flaw was found.

According to researcher Nikita’s description, the attacker first submitted a signature bundle. Then, through the AddCollateralAdmin call, they assigned themselves as administrator. After that, the contract rechecked the wrong key. That opened the way to withdraw funds.

The numbers here are telling. The attacker wallet was funded with about $190 in USDC transferred from Ethereum. After that, the withdrawals began. By the time of the researcher’s analysis, there were already 8,857 transactions. The first batch of about $576 000 was drained in 15 minutes.

Why does this matter for card users?

Because here, it was not the exchange or the project treasury that was hit. The withdrawals came directly from individual card accounts. For the user, it looks like a normal debit, even though technically the problem sits in the contract.

Avici separately stressed that its funds were not compromised. The company also said it had updated the vulnerable contract across all programs. No new unauthorized operations were recorded after that.

“All affected card balances will be fully reimbursed,” Avici said.

For the market, this is an important signal. Blockchain card products often look simple to the user. But one authorization mistake can give access to hundreds of accounts at once. That is exactly what happened.

Market reaction

AVICI reacted sharply. At the time of writing, the token was trading at $0,3086. CoinMarketCap also recorded $0,2673, a 37,95% drop over 24 hours, an intraday range of $0,2189–$0,4459, a market cap of $3,45 million, and trading volume of $1,19 million.

There is also broader context. AVICI’s all-time high was $7,61 on 26 November 2025. The all-time low, $0,2189, was recorded on 28 August 2026. That means the token was about 96,5% below its peak.

Another loss estimate is worth mentioning as well. CertiK Alert spoke of about $1,02 million, while BlockWatchdog reconstructed $1 115 978 across 4 programs. That is a broader picture, not just Avici clients. That is why the market is more nervous than it would be after a normal technical glitch.

• 1,685 users were affected.

• Avici’s official loss amount was $500 859,22.

• The attacker wallet started with about $190.

• There were 8,857 transactions at the time of analysis.

• The first batch of $576 000 was drained in 15 minutes.

• AVICI fell by 37,95% over the day.

What does this mean for investors?

For AVICI holders, this is first and foremost a matter of trust. If the team really compensates 100% of the losses, that will ease some of the pressure. But the exploit itself is already hurting the token’s reputation and people’s willingness to keep money in it.

For card users, the takeaway is simple. You need to look not only at the brand, but also at how the funds are stored. If the card balance lives in a separate contract, then that contract becomes the weak point.

Avici also reported one more step. The team filed a complaint with the FBI Internet Crime Complaint Center. Rain, the infrastructure partner, also said it had external forensic experts and would continue monitoring. This no longer looks like an attempt to bury the story.

Ukrainian users also have something to think about here. If you keep funds in crypto card services, check exactly where the balance is held and who controls it. If you need to quickly convert coins into hryvnia, you can sell USDT TRC20 for hryvnia to a card without extra steps.

Frequently asked questions

Were Avici users’ wallets affected?

No, according to the company, self-custodial Solana and EVM wallets were not affected. The problem only touched card balances in the vulnerable contract. That is where $500 859,22 was lost.

Why did the AVICI token fall so sharply?

The market reacted to the exploit itself and to the scale of the withdrawals. In the wake of the incident, AVICI fell by nearly 28%, and CoinMarketCap recorded a 37,95% daily drop. For small tokens, news like this hits especially hard.

Will Avici compensate the losses?

Yes. The company said that all affected card balances will be fully reimbursed. Avici also reported updating the contract and no new unauthorized operations after the upgrade.

The Avici story shows a simple thing: in crypto cards, the weak point is often not the wallet, but the intermediate contract.

This material is not financial advice. Cryptocurrency trading involves significant risks. Part of this text was prepared with the help of artificial intelligence based on public sources and reviewed by our editorial team.