Rain Card Exploit Affects Avici Users: Solana Contract Vulnerability Explained

Topics: blockchain · Difficulty: intermediar

Attila Kiraly — Strateg AI & Educator · · 3 min read

Reprezentare digitală a unui card de credit peste un fundal cu logo-ul Solana și elemente de securitate cibernetică

Originally published: August 28, 2026

Card issuer Rain reported an exploit on an outdated version of its Solana smart contract, affecting 1,685 Avici users. The attacker drained approximately $500,859, but both companies have confirmed that affected users will be fully reimbursed.

What happened

The Solana ecosystem recently experienced a security breach targeting users of the neobank Avici, facilitated through its card infrastructure partner, Rain. An attacker exploited a vulnerability in a "deprecated" (outdated) version of Rain's smart contract, which was still being utilized by a small subset of programs. Official reports confirm that 1,685 users were affected, resulting in a total loss of $500,859. While initial reports suggested higher figures exceeding $1 million, Avici clarified the actual impact and assured that all affected users would be made whole by the companies involved.

Technology context

The incident took place on the Solana blockchain, a high-performance network that requires meticulous management of smart contract versions. Rain acts as a crypto card issuer, bridging digital assets with traditional payment systems. The vulnerability stemmed from the fact that an older version of Rain's code remained active on-chain despite newer, secure versions being available. In decentralized environments, old contracts do not simply disappear; unless they are explicitly paused or permissions are revoked, they remain accessible. Attackers often scan for these "forgotten" contracts to exploit logical flaws that were fixed in later iterations.

Why it matters

This event highlights a critical challenge in Web3: software lifecycle management. For the end-user, it demonstrates that security is only as strong as the weakest link in the technical supply chain. The rapid response from both Avici and Rain, including the commitment to full reimbursement, reflects an increasing level of corporate responsibility in the crypto space. However, it also serves as a warning about the risks associated with integrating multiple layers of decentralized protocols where legacy code might still be running.

Key terms explained

Impact

In the short term, the exploit triggered concern among Avici's user base and led to the temporary suspension of card services to prevent further losses. In the medium term, this incident will likely drive DeFi protocols and infrastructure providers to adopt more rigorous "sunset" procedures for legacy code. While the immediate financial damage is being mitigated by the companies, the incident emphasizes the need for continuous security monitoring of all active contract versions, not just the most recent ones.

What's next

We anticipate that future security audits will focus more heavily on third-party integrations and the risks of legacy code persistence. The industry is moving toward implementing automated kill-switches and migration paths that force users and programs off older, less secure versions. The successful resolution of this incident, through full user reimbursement, will likely set a benchmark for how hybrid crypto-fiat fintechs handle security crises in the current regulatory environment.

Sources

*

Educational analysis generated by AI and editorially reviewed.

Original source: thedefiant.io

Want to learn the fundamentals? What is Solana?

Frequently Asked Questions

How much money was lost in the Rain Card exploit?

Avici confirmed a total loss of $500,859, impacting 1,685 users.

Will affected users receive their funds back?

Yes, both Rain and Avici have committed to making all affected users whole.

Why was a deprecated contract still vulnerable?

Smart contracts remain live on the blockchain unless explicitly disabled; the attacker found a flaw in a version that was no longer being monitored.

Was the Solana network itself hacked?

No, the exploit targeted a specific application's smart contract (Rain), not the underlying Solana blockchain protocol.

What is the lesson for other Web3 companies?

Companies must ensure that old versions of their code are properly decommissioned and that all partner integrations are secure.

Glossary Terms

Continue Learning

Explore more insights about technology, automation, and Web3 in the EduWeb Academy.

Explore Academy