Rain crypto card infrastructure vulnerability leads to $932,000 theft

A vulnerability in an outdated Solana smart contract provided by Rain, an infrastructure provider for crypto cards, led to the unauthorized withdrawal of funds from several card programs. The breach primarily affected funds held in contracts used for card balances rather than users' self-custody wallets.

Two services, Avici and Tria, reported significant losses. Avici stated that 1,685 users had a combined total of $500,859.22 in card balances affected. Tria reported that 636 users lost a total of $431,945. In total, at least 2,321 individuals were impacted, with combined losses exceeding $932,000.

Rain has since upgraded the affected programs to resolve the vulnerability. Both Avici and Tria announced that they completed full refunds to all affected users by August 30, with Avici and Tria also providing an additional 10% compensation to those impacted. Avici reported the incident to the FBI’s Internet Crime Complaint Center (IC3).