An attacker is draining customer funds from Avici, a Solana neobank whose self-custodial (users retain control of funds) Visa cards are backed by crypto balances. The attacker bypassed Avici's passkey-based authorization layer by registering a new administrator on users' collateral accounts before withdrawing assets. The attacker's wallet held 10,005.03 SOL worth about $1.07 million at 18:58 UTC, as well as roughly $11,600 in USDC and USDT, according to Solana RPC data queried by The Defiant. Its SOL holdings had increased by about 2,595 tokens, or roughly $277,000, during the previous 11 minutes. Avici said at 18:42 UTC that it was working with relevant partners, but has not explained how the funds were taken, how many accounts were affected, or whether users will be reimbursed. Transaction logs show a repeated three-step sequence: signature submission, administrator registration and collateral withdrawal. One transaction moved 2,346.77 USDT from a user's collateral account to the attacker's token account. Avici's AVICI token fell 49.4% to $0.2175, giving it a $2.84 million market capitalization, while the wider DeFi sector recorded about 70 exploits and $746 million in losses during the second quarter.