Rain Solana contract hack: at least $932,804 stolen from 2,321 Avici and Tria users

Why this is a Rain contract hack

This was not a problem confined to Avici's own application. Rain was the common card infrastructure provider. Rain says attackers exploited a vulnerable, outdated version of its Solana card contracts used by a small number of programs. Avici and Tria are the two affected programs that have published user and loss figures.

Avici reported $500,859.22 taken from 1,685 card balances. Tria later reported $431,945 taken from 636 card balances. Together, those first-party disclosures confirm at least $932,804.22 stolen from 2,321 users. Rain has not published a complete program list or a higher official cross-program total.

Onchain analysis places the first known malicious transaction at 16:49:48 UTC on August 28. Avici acknowledged abnormal card-balance withdrawals at 18:42 UTC. Tria reported unauthorized Solana USDC and USDT withdrawals at 20:20 UTC. Rain disclosed the vulnerable contract version at 20:26 UTC and said it upgraded every program still using it.

The reimbursement status has also changed since the first version of this article. On August 29, Avici and Tria each said every affected user had received the full amount plus an additional 10%. Avici said Rain covered its reimbursements. Rain later said all impacted cardholders had been repaid and every program was operating normally. These are provider statements; no independent reconciliation has been published.

How the withdrawals were executed

The Defiant identified a suspected address that received 1.79 SOL through deBridge at about 13:40 UTC and first interacted with Avici-related contracts at 16:49:48 UTC. At 18:58 UTC, the address held 10,005 SOL plus about $11,600 in USDC and USDT, worth more than $1 million at the prices used in that report.

That point-in-time balance is not an official final loss. Transactions reviewed by The Defiant repeatedly used signature-submission and Ed25519 verification calls before functions labelled AddCollateralAdmin and WithdrawCollateralAsset. One reviewed withdrawal moved 2,346.77 USDT from a collateral account.

A public tracker counted 125 distinct sending accounts in its observation window. The suspected address had signed 14,672 transactions, of which 2,344 failed. Neither number is a verified victim count, and they do not support the circulating claim that more than 9,000 users were drained.

By 22:33 UTC, Solscan showed the suspected address with 0 SOL and $0 total value and marked the base account as no longer existing onchain. Its recent activity table listed swaps and outbound transfers, including one transfer of 886.94 SOL. This changes the earlier balance snapshot but does not establish the full destination trail or show that any money was recovered.

Solscan records that final 886.94 SOL moving through two intermediary addresses. At 19:34:39 UTC, the last address swapped 886.92 SOL for about 91,716 USDC and submitted 90,961.83 USDC to Ethereum through deBridge. A second deBridge order at 19:35:44 UTC submitted another 747.03 USDC.

The Ethereum address identified in the new onchain analysis is marked by Etherscan as funded by deBridge. Its transaction history contains 22 deposits to the Tornado Cash Router totalling 455.8 ETH: four deposits of 100 ETH, five of 10 ETH, five of 1 ETH and eight of 0.1 ETH. Etherscan showed 0.036 ETH left at the latest source check.

The onchain route should not be presented as Rain's official loss total. The published Avici and Tria reconciliations add up to $932,804.22. Rain has not allocated the remaining difference between that figure and larger onchain estimates across other programs, exchange-rate movement, swaps or unrelated activity.

The transaction sequence shows abuse of an authorization path. It does not yet show whether the underlying cause was faulty signature validation, a compromised trusted signer or backend service, or valid signatures obtained through phishing. Rain's forensic investigation has not published a technical conclusion.

Which card programs were affected?

Avici and Tria have confirmed unauthorized withdrawals and published loss figures. Their statements say the affected assets were Solana funds moved into separate card-balance contracts. Their ordinary self-custodial wallets and EVM card balances were not affected.

Jupiter Card belongs in a different category. Its card partner briefly paused card-balance withdrawals while running security checks. Jupiter said the pause was precautionary, card payments continued, withdrawals resumed, no Jupiter accounts or onchain wallets were affected and customer funds were never at risk.

KAST, Solayer Pay and ether.fi Cash each said they were unaffected. Rain says other programs were not impacted, but it has not named every program that used the vulnerable version. A customer list, a shared issuer or a temporary pause is not evidence that a particular card was hacked.

Rain describes Rain-Managed and Partner-Managed operating models, but its incident statement does not map the vulnerable deployments to either model. The hack shows that a self-custody claim for the wallet does not automatically cover funds moved into a separate card-balance contract. That distinction is established by the providers' own incident updates; the exact authorization flaw still awaits a technical postmortem.

Claims not supported by current evidence

The suspected Solana address was initially funded through deBridge. The later Solscan and Etherscan records now support a route back through deBridge and 22 deposits from the identified Ethereum address to Tornado Cash. They do not establish that the full amount routed through that address is the official cross-program loss. No primary incident statement reviewed for this update supports the Circle allegation, a 9,000-user count or claims that every Rain customer was exposed.

What affected users should do now

1. Check the restored card balance and recent Solana USDC or USDT transactions in the provider's official app and a block explorer.
2. Save transaction IDs, timestamps and screenshots for any withdrawal that was not authorized.
3. If the balance or the announced additional 10% credit is missing, contact the provider through its official support channel.
4. Ignore unsolicited recovery messages, links or requests for a seed phrase, private key or passkey.
5. Follow notices from the specific card provider. A general list of Rain customers does not prove that a program was exposed.

What remains unknown

The next material updates are the complete affected-program list, total loss across all programs, the destination or recovery status of the transferred funds, technical root-cause analysis, an explanation for why outdated contract deployments remained live and findings from the third-party forensic investigation. Rain says law enforcement is involved, but it has not published a postmortem or recovery figure.