Avici confirms full refunds for users after Solana card exploit

A smart contract exploit that briefly looked like it could sink a promising Solana neobank is now producing a different kind of headline. Avici has confirmed full refunds for all 1,685 users whose card balances were affected by the August 28 breach, and the market responded immediately: the BANKJ token jumped more than 50% on the news. That recovery, while sharp, arrives against a backdrop of serious damage. The exploit cost affected users somewhere between $650,000 and $1 million, depending on which accounting method you use, and briefly wiped between 32% and 49% off the AVICI governance token’s value. What actually happened on August 28 Avici is built as a self-custodial neobank on Solana. The core product pairs a Visa Signature card with smart wallets that hold user funds until the moment a card transaction settles at point of sale. The exploit broke that model in a targeted way. Attackers found vulnerabilities in three smart contract operations: SubmitSignatures, AddCollateralAdmin, and WithdrawCollateralAsset. By chaining those operations together, they were able to claim unauthorized admin rights over roughly 1,100 collateral accounts and then drain them through a series of s...