An attacker is draining customer funds from Avici, the Solana neobank that issues Visa cards backed by users' crypto, and had taken more than $1 million by press time.
Avici sells its card as self-custodial, with balances held in onchain accounts users authorize through passkeys instead of seed phrases. The attacker went through that authorization layer, calling an instruction that registers a new administrator on a user's collateral account and then withdrawing the balance.
The attacker's wallet, FVNFzq QnCEj, held 10,005.03 SOL worth about $1.07 million, plus roughly $11,600 in USDC and USDT, according to Solana RPC data queried by The Defiant. Its SOL balance grew by about 2,595 tokens, some $277,000, in the previous 11 minutes.
Avici said it is "working directly with all relevant partners to resolve it and will share updates as soon as we have more information." The company has not said how the funds were taken, how many accounts are affected, or whether it will make users whole.
Authorization is the whole game, and Vulpine keeps its blast radius deliberately tiny: private keys never leave your device, every message is end-to-end encrypted, and an account is nothing but a token shown once and stored only as a hash - so there is no admin layer over user funds, or user secrets, to instruct.