$500K Vanished at the Edge of "Self-Custody": How an Outdated Rain Contract Exposed Vendor Risk in Stablecoin Card Infrastructure

What Happened

The attacker first obtained a trivial 1.79 SOL through the cross-chain bridge deBridge, waited roughly three hours, and triggered the first malicious transaction at 16:49:48 UTC. In total, the attacker address signed 14,672 transactions, of which 2,344 failed. On-chain monitoring initially estimated losses above $1 million, but Avici's final reconciliation fixed the figure at 1,685 of its own users and $500,859.22.

The Real Failure: An Old Version Left Running

The technique had three stages. The attacker submitted forged signature data, then granted itself administrative authority over individual user collateral accounts, then withdrew assets under that authority. This was not a failure of blockchain consensus or of Solana itself. The cause was an outdated version of Rain's Solana contract that remained live across a handful of programs. The structure mirrors the June 2026 exploitation of Raydium's deprecated liquidity pools: the operational gap of migrating to a new version without decommissioning the old one keeps being targeted.

Where Does the "Self-Custody" Claim End?

Both Avici and Tria position themselves as self-custodial neobanks, and their users' Solana and EVM wallets were indeed unaffected. But the moment a user tops up a card, funds leave the self-custodial wallet and move into a separate collateral contract controlled by Rain. That is precisely where the money disappeared. Notably, Tria's own January 2026 transparency report had anticipated that clarity around self-custody and liability boundaries would grow in importance through 2026.

Payment Infrastructure as a Single Point of Failure

The gravity of this incident is not measured in dollars drained. In January 2026, Rain raised $250 million in a Series C led by ICONIQ, reaching a valuation of approximately $1.95 billion. As a Visa Principal Member it processes over $3 billion in annual transaction volume across more than 150 countries and partners with Western Union. Shared B2B infrastructure is economically compelling, but shared infrastructure also means shared vulnerability. Rain has engaged third-party forensic investigators and stated it will coordinate with law enforcement and relevant regulators.

Unresolved Questions: Reimbursement and Freezing

Rain, Avici and Tria have all committed to full reimbursement, but neither the timeline nor the party ultimately bearing the cost has been disclosed. Separately, stablecoin issuer Circle drew public criticism for not freezing the USDC involved. In April 2026 the company stated that freezing should follow legal orders rather than corporate discretion, and its decision not to freeze funds in the roughly $280 million Drift Protocol exploit drew a class action suit. In this case the attacker moved proceeds to Ethereum, converted them into approximately 418 ETH and routed them through a mixing service, making recovery effectively impossible. The AVICI token fell roughly 38% in 24 hours to an all-time low near $0.219.

Implications for Japanese Practitioners

In Japan, a Cabinet Office ordinance amendment effective June 1, 2026 formally recognized foreign-issued trust-type stablecoins as electronic payment instruments. The legal foundation for domestic stablecoin-denominated card programs is falling into place. Against that backdrop, this incident makes one point unavoidable: version management of smart contracts operated by an external vendor is itself a core component of vendor oversight.

[Business Development Insights]

1. Vendor oversight must explicitly cover which contract versions are live. Conventional vendor management focuses on organizational, personnel and information security controls, yet the trigger here was a pure configuration-management failure — an abandoned contract version left running. Requiring the infrastructure provider to periodically report a complete inventory of live deployments by version, plus written confirmation that deprecated versions have been shut down, is the highest-return contractual measure available.
2. Disclosing the exact moment customer assets leave self-custody becomes a differentiator. Many affected users likely did not understand that funds they topped up had moved into a shared contract under vendor control, despite using a service marketed as self-custodial. A provider that can diagram, at the point of product explanation, which action transfers custody and who bears reimbursement responsibility at that moment aligns with Japanese disclosure standards and gains a clear advantage with institutional and corporate clients.
3. Reimbursement funding and freeze authority must be designed around the issuer's stated policy. Circle has made clear it will not freeze USDC absent a legal order, so issuer-level freezing cannot be treated as a reliable remedy. Any party structuring a card program should fix the reimbursement ceiling, the source of funds (own capital or insurance) and the days-to-payment commitment in both internal policy and customer terms before launch.

[Sources]

CoinPost, "Approximately $500K drained from Avici card balances, Tria also affected; full reimbursement promised" (August 29, 2026) https://coinpost.jp/?p=734151 Avici official statements (X) https://x.com/avici/status/2093408878663000074 and https://x.com/avici/status/2093439613201482068 Rain official statement (X) https://x.com/raincards/status/2093435073081053518 Tria official statement (X) https://x.com/useTria/status/2093433665258963450 Crypto Adventure, "Avici to Refund 1,685 Users After $500K Solana Card Contract Exploit" (August 29, 2026) https://cryptoadventure.com/avici-to-refund-1685-users-after-500k-solana-card-contract-exploit/ crypto.news, "Avici attack drains over $1M from Solana users" https://crypto.news/avici-attack-drains-over-1m-dollars-from-solana-users/ Cryptopolitan, "Avici pledges full refunds as hackers hit Ajna next" https://www.cryptopolitan.com/avici-pledges-full-refunds-ajna-next/ BlockchainReporter, "Avici Card Contract Vulnerability Affects 1,685 Users" https://blockchainreporter.net/avici-solana-card-contract-vulnerability Tria, "Tria Transparency Report: Progress, Operations, and Next Steps" (January 2026) https://usetria.medium.com/tria-transparency-report-progress-operations-and-next-steps-07d878785082 CoinDesk, "Circle CEO says he won't freeze USDC without a court order" (April 13, 2026) https://www.coindesk.com/business/2026/04/13/circle-ceo-says-he-won-t-freeze-usdc-without-a-court-order-even-as-hackers-walk-away-with-millions Reuters, "Stablecoin firm Rain valued at $1.95 billion in latest fundraise" (January 9, 2026) https://www.reuters.com/technology/stablecoin-firm-rain-valued-195-billion-latest-fundraise-2026-01-09/ CoinPost, "FSA formally recognizes foreign-issued stablecoins as electronic payment instruments; Cabinet Office ordinance amendment promulgated" (May 19, 2026) https://coinpost.jp/?p=709645