A Deprecated Rain Card Contract on Solana Gave an Attacker Admin Control and 1.1 Million Dollars

An outdated version of a card contract from the crypto card infrastructure firm Rain let an attacker take administrative control of individual card-collateral accounts on Solana and withdraw their balances, taking about 1.1 million dollars from programs that relied on it. The root cause was access control in a deprecated contract that customers were still using, not a novel cryptographic break.

The neobank Avici said roughly 500,800 dollars was taken from 1,685 users, and Tria reported losses above 430,000 dollars across 636 users. Both said they would reimburse affected accounts in full. Rain said it identified the problem in the outdated contract version and upgraded the programs still running it, and reported no further unauthorised activity afterwards. The AVICI token fell as much as 49 percent. Blockchain data showed the attacker converted the stolen stablecoins into SOL, moved them across networks, and routed them through Tornado Cash.

Two smaller incidents also mattered this week. Researchers at DeFiHackLabs published a proof of concept for spot-price manipulation of a Hypervisor position on FloatProtocol using Uniswap V3, the standard pattern in which a protocol reads an instantaneous pool price instead of a time-weighted one. Separately, KiiChain said an attacker moved 148.3 million KII tokens out through the Hyperlane bridge to BNB Smart Chain across 18 transactions on 22 August, and has not published a dollar figure or an attribution. Rekt News is tracking that incident alongside Mantra, Term Labs and TAC.