A vulnerability in a deprecated Rain smart contract drained approximately $1.1 million from card-collateral accounts across several Solana-based crypto-card platforms. Avici reported $500,800 in losses affecting 1,685 cardholders, while Tria said 636 users were affected and losses exceeded $430,000. Both companies pledged to fully reimburse customers; Avici also filed a complaint with the FBI’s Internet Crime Complaint Center. The attacker repeatedly submitted signed authorizations, added themselves as an administrator to individual card-collateral wallets and extracted funds. The stolen stablecoins (digital tokens designed to track fiat values) were converted to SOL, bridged to Ethereum and routed through Tornado Cash, a crypto mixing service that obscures transaction trails. Rain, the infrastructure provider for stablecoin card services and a Visa principal member, said its monitoring identified the weakness in a legacy contract version. Platforms using the affected version were upgraded immediately, and Rain said it had detected no subsequent malicious activity. Avici said the breach was limited to a specific Solana smart contract (self-executing blockchain code) holding funds deposited when customers loaded card balances; user-controlled wallets on Solana and Ethereum-compatible chains were not affected. AVICI fell 49% from its 24-hour peak of $0.43 to an all-time low of $0.217 before later stabilizing around $0.378, while Tria’s native token temporarily declined more than 10%. The companies have not identified other affected platforms, leaving the total loss unclear. The gap between blockchain-tracked losses and Avici’s disclosure suggests additional Rain-integrated platforms may also have been affected. The incident highlights the custody difference between self-custodial wallets and card balances held through third-party infrastructure. Crypto-card transaction volume rose more than threefold to $1.04 billion in July, with stablecoins representing 70% of more than 10 million transactions. Avici’s service agreements identify Third National as the official card issuer and Rain as the underlying technology provider.