Solana-based neobank Avici will refund 1,685 users in full after an attacker exploited an outdated card contract supplied by its issuing partner Rain, draining $500,859.22 from customer card balances. The final reconciliation came after early onchain estimates put the attack above $1 million as funds rapidly accumulated in attacker-controlled addresses. Avici’s self-custodial Solana and EVM wallets were not affected. The vulnerable infrastructure was the separate Solana contract holding balances that users had moved into the card system.