A vulnerability in an outdated Rain Solana card contract drained approximately $1.1 million from Avici, Tria and other card programs, including about $500,800 from 1,685 Avici users and more than $430,000 from 636 Tria users. Avici fully refunded affected users, added 10% cashback and said the breach was limited to card balances held in the Rain-managed contract after top-ups; self-custodied Solana and EVM wallets, EVM card balances, fiat deposits and withdrawals, and token swaps were unaffected. Rain upgraded programs using the vulnerable version, reported no further malicious activity and began a forensic investigation. Separately, Ajna v2 lost about $775,400 across seven Ethereum pools between August 28 and August 29, 2026, in an apparent internal liquidation-accounting attack rather than an external-oracle exploit, and urged users to withdraw assets, repay loans and stop using the protocol.