Avici protocol drained of $670K via authorization bug in collateral accounts
Security & Exploits ·
An attacker spent $190 in gas to extract $670K from over 1,100 Avici user accounts by exploiting a signature-verification flaw rather than a stolen key.
According to a post on x.com, the attacker's wallet was created at 13:40 UTC and funded with $190 in USDC bridged from Ethereum, an amount sufficient only to cover gas fees. Draining began at 16:49 UTC and was still running as of the report, with 8,857 transactions recorded. The method was consistent across every affected account: the attacker submitted a signature bundle, called AddCollateralAdmin to grant themselves admin status, then withdrew funds.
The root cause traces to a flawed second signature check that pointed back at instruction 0, causing Solana to verify the attacker's own signature twice instead of validating a separate authorization. This allowed the program to credit an admin key it should never have accepted, leaving the attacker with admin control over more than 1,100 collateral accounts. Per-account losses varied widely: the median amount taken was $24, while the largest single account lost $5,268.
A first batch of roughly $576K moved off the attacker's wallet between 18:19 and 18:34 UTC, with additional funds continuing to accumulate afterward. Avici has confirmed the exploit occurred. Notably, the protocol's program was neither upgraded nor replaced during the incident, and its upgrade key has reportedly not been touched since March 2025, supporting the characterization of this as an authorization bug rather than a compromised deploy key.
Separately, users of the Avici neobank product have reported drained accounts in what appears to be the same incident, corroborating the on-chain findings. One circulating claim, that this represented a treasury drain, does not match the transaction pattern: funds were extracted from individual user collateral accounts one at a time rather than from a pooled treasury.
Unresolved questions include the total final amount drained, since the exploit was still active at time of reporting, whether Avici will pause the protocol or reimburse affected users, and what remediation steps will be taken to close the authorization gap. The incident has also prompted broader scrutiny of admin-control assumptions in protocols marketed as non-custodial.