Rain contract exploit drains $1.1 million from Solana card programs
A big crypto card hack on August 30, 2026, drained roughly $1.1 million across several Solana-based programs, including Avici and Tria.
The attacker found a loophole in an old Rain card contract, grabbed funds multiple times, swapped stablecoins to SOL, moved them to Ethereum, and tried to cover their tracks with Tornado Cash.
Avici loses $500,800 and Tria $430,000
Avici lost $500,800, affecting 1,685 users. Its AVICI token dropped by almost half before bouncing back a bit.
Tria saw losses over $430,000, with 636 users impacted, and its token down by over 10%.
Both companies promised compensation but have not given details yet.
This breach is a wake-up call about the risks of third-party custody as crypto cards get more popular: spending reached $1.04 billion in July.
Rain upgrades affected card programs
Avici reported the incident to the FBI's Internet Crime Complaint Center.
Rain traced the problem to an outdated contract and has since upgraded every program running that version to fix it.
Self-custodial wallets were not affected this time, a small relief for those who keep their own keys safe.