Rain Contract Bug Drains $1.1M From 'Self-Custodial' Crypto Cards

On 28 August 2026, crypto-spending neobank Avici disclosed that an exploit against its card infrastructure had drained roughly $500,859 from 1,685 customers. Within hours it emerged that a second neobank, Tria, had lost more than $430,000 across 636 users to the same root cause: a bug in an outdated version of a Solana smart contract operated by Rain, the payments processor that powers both companies' Visa card programs. Combined losses reached about $1.1 million, and Avici's token fell as much as 49% on the news.

How the exploit worked

Rain's card contracts hold the stablecoin balance a customer moves over when they top up a crypto-linked debit or credit card. According to transaction analysis reported by outlets covering the incident, the attacker repeatedly submitted a signed authorization against an outdated version of this contract, used it to add itself as an administrator on individual card-collateral accounts, and then withdrew the balances directly. The stolen stablecoins were swapped into SOL, bridged to Ethereum, and ultimately funnelled through the mixer Tornado Cash — a laundering path now routine in Solana-native exploits.

Rain said the bug affected only a "small number of programs" still running the vulnerable contract version, and that it upgraded those programs once the issue was identified, with no further unauthorized activity reported since.

Why 'self-custodial' didn't protect anyone here

Both Avici and Tria market their card products as self-custodial — normally shorthand for "the customer's private keys, the customer's funds, no counterparty risk." Avici confirmed that customers' actual self-custodied wallets were untouched; the funds lost were the balances customers had *already moved into* Rain's shared card-collateral contract to fund upcoming card spend. That contract is infrastructure the neobanks don't control end-to-end — it's a third party's smart contract, holding pooled or per-account balances, sitting between the wallet and the merchant rail.

That's the pattern worth flagging: a self-custody claim is only as strong as the narrowest point where funds leave the user's own keys. A "self-custodial" card product that requires a top-up step into an intermediary contract has, at that moment, the same smart-contract risk profile as a custodial exchange balance — a single implementation bug in one shared contract can drain many accounts at once, which is exactly what happened here.

What this means for teams building on shared infrastructure

• Inherited risk is still your risk. Avici and Tria didn't write the vulnerable code, but their customers lost money and their tokens took the reputational hit. Relying on a shared processor's contract doesn't transfer accountability to end users.
• Admin-role logic on financial contracts is a high-value target. A flaw that lets an external caller add itself as an account administrator is a privilege-escalation bug, not an edge case — this is exactly the class of finding an adversarial audit or targeted contract review is built to catch before deployment, not after a stale version ships to production.
• "Self-custodial" is a claim to verify, not a label to trust. Any product using that term should be able to show precisely which contract holds funds at every step of the flow, and who can call which functions on it.

What happens next

Avici publicly committed to refunding every affected user in full and said it remains in contact with its card-issuing and security partners; Tria made a similar pledge. Neither company has published a completed-refund confirmation or exact timeline as of this writing.