The Avici Exploit: How Smart-Contract Attacks Drain Crypto — and How to Protect Yourself

On 29 August 2026, the Solana-based web3 "neobank" Avici suffered a major exploit that drained over $1 million in user collateral. More than 1,100 collateral accounts were hit, with over 10,005 SOL and large sums of stablecoins moved to the attacker's wallet. The market reaction was brutal: the native $AVICI token crashed roughly 49% to an all-time low of about $0.21, wiping out nearly half its market cap in hours.

What makes Avici worth studying isn't the size of the loss — it's how ordinary the mistake was. This wasn't unbreakable cryptography being defeated. It was a locked front door next to an unlocked side door, and a single master key where there should have been several.

Avici marketed total self-custody — the promise that only your own wallet could ever move your funds. In practice, its program code left a privileged path open. According to security analysts and on-chain data (as reported via Binance News), the attacker ran a tight, repeatable three-step loop:

1. SubmitSignatures — the attacker called Avici's authorization program and pushed through a crafted bundle of signatures.
2. AddCollateralAdmin — that let them register themselves as an administrator on individual users' escrow accounts. They didn't need your wallet; they made themselves your account's admin.
3. WithdrawCollateralAsset — now holding admin rights, they simply withdrew the USDC and USDT collateral backing users' crypto Visa cards.

Repeat across 1,100+ accounts, and you have a seven-figure drain.

Two structural failures made it possible:

• A broken privileged path. The "add an admin" function should have been impossible for anyone but the legitimate owner to call. It wasn't. The self-custody guarantee existed in the marketing, but not fully in the code.
• Centralised key control. Both compromised Avici programs shared a single standard Solana account for upgrade privileges — one key that could change the code — instead of a multisig requiring several independent approvals. One key is one point of failure.

Avici acknowledged the issue nearly two hours after the first drainage transaction and said it is working with security partners to secure the contracts. In crypto, two hours is a lifetime.