Back
Oobit
Back
Oobit
August 30, 2026
•
4
min read
Table of contents
Why the AVICI Exploit Isn't a Classic Treasury Hack
Market Reaction to the Avici Hack
What Avici Hasn't Answered Yet
The Bigger Lesson From the Avici Hack
How much was stolen in the Avici hack?
How did the Avici exploit happen?
Why did the AVICI token price crash?
✓
An attacker drained over $653,000 from card collateral vaults at Avici, a Solana neobank whose own documentation promised that only a user's wallet could ever move that money. The Avici hack has since pushed the AVICI token down nearly 40%, wiping out value equal to close to a fifth of its total market cap.
Avici sells a Visa credit card backed by USDC, similar in concept to Oobit's own self-custodial crypto card. Users lock the stablecoin in a smart contract, and spending draws it down. Third National issues the card itself, not Avici.
Avici's own documentation states that only a user's wallet can withdraw funds from the escrow contract after deducting spends, making clear who was supposed to hold the keys. On August 28, 2026, the vaults emptied anyway, with a live on-chain tracker counting $653,548 pulled out.
Self-custody set out who could not take the money. It did not remove every privileged path written into the program itself, and that gap is where the funds went. On-chain researchers say the attacker submitted a crafted signature bundle, made itself an admin on the escrow accounts, then withdrew the funds. Avici has not confirmed this as the official attack vector.
Each Avici customer holds a separate escrow contract, so there was no single treasury to empty in one transaction. The attacker instead had to compromise vaults one account at a time, a meaningfully different failure mode than a governance exploit that drains an entire pooled treasury in a single stroke, such as the $20 million taken from a BONK DAO treasury.
What both incidents share is a privileged code path that should not have existed. For Avici, that path directly undermined a non-custodial claim made in its own product documentation.
Crypto markets tend to punish trust failures harder than the raw dollar figure alone would suggest. AVICI fell roughly 40% to around $0.24 following disclosure of the exploit, erasing value beyond the amount actually stolen. A similar pattern played out when Midnight's token hit a record low after a bridge breach in July, another case where a security failure did more damage to the token than to the balance sheet.
As of this writing, Avici has said only that it is aware of an issue affecting card balance withdrawals. No post-mortem has been published, and two operational questions remain open:
Until Avici answers those questions, users with funds still locked in its escrow contracts are left deciding whether to attempt withdrawal or wait for an official response.
The Avici hack is a reminder that a self-custodial claim describes intent, not a guarantee about code. A smart contract can be written so that only a user's wallet is supposed to move funds and still contain an admin-level path that was never meant to be reachable, whether from an oversight, a misconfigured access control, or an escape hatch nobody expected to be used. For a crypto payments platform issuing cards tied to real spending, the relevant security question is not whether users can move their own money. It's whether anything else can.
It is also a reminder to check how a provider actually handles stablecoin payments before locking funds into any card vault, since the marketing claim and the underlying contract logic are not always the same thing. Platforms that show costs and settlement terms upfront, the way Oobit's Send Crypto feature does before a transfer is confirmed, give users less reason to guess how their funds actually move once locked in.
Until Avici publishes a full technical breakdown, the exact cause of the exploit remains unconfirmed, but the damage to user trust and to the token is already done.
Avici is a Solana-based neobank offering a USDC-funded Visa card. Users lock stablecoin into a smart contract vault, and card spending draws down that balance, with Third National acting as the card issuer, a different custody model than an app-based crypto debit card that draws directly from a connected wallet.
An on-chain tracker recorded over $653,000 drained from Avici's escrow vaults, equal to roughly a fifth of the AVICI token's total market value at the time.
Avici has not officially confirmed the method. On-chain researchers say an attacker submitted a crafted signature bundle that granted itself admin rights over individual escrow accounts, then withdrew the funds directly.
Avici has only confirmed it is aware of an issue affecting card balance withdrawals. As of this writing, no post-mortem has been published and it remains unclear whether unaffected vaults are safe to access.
AVICI fell roughly 40% to around $0.24 after the exploit was disclosed. Token prices often fall harder than the dollar amount stolen when an exploit undermines a platform's core security claims.
Reporting based on BeInCrypto via Yahoo Finance.
Open your treasury, hold dollars, and start paying the world.
Abre tu tesorería, guarda dólares y empieza a pagarle al mundo.
Abra seu tesouro, guarde dólares e comece a pagar o mundo.
If you're excited by the future of money, we'd love to hear from you.
Scan the QR code to download the app
The People's Money.
Pay with Oobit
Crypto CardLocal QR PaymentsATM WithdrawalsCrypto Cashback Agent CardsOobit DePay
Pay with BitcoinPay with OOBPay with USDTPay with EthereumPay with SolanaStablecoin
Oobit For Business
BlogStablecoin PaymentsGlobal USDCorporate CardExpense Managment
Oobit Technologies 2026. © All rights reserved.
Oobit provides technology that enables users to spend digital assets through existing payment networks. Services are subject to regional availability and regulatory requirements. Oobit operates through multiple entities globally. Certain features may be provided by licensed partners depending on your location.
US Cryptocurrency services are provided in partnership with Bakkt Financial Solutions I, LLC. Bakkt is registered with FinCEN as a Money Services Business (MSB) and holds state money transmitter licenses.