Rain Solana card contract exploit drained about $1.1 million across multiple programs

How the exploit worked

Rain provides the infrastructure that lets crypto companies issue payment cards funded with stablecoins. When customers load those cards, the assets are moved into onchain collateral accounts managed by Rain-linked contracts, separate from funds held in personal wallets.

According to Blockaid, the vulnerable contract required two independent approvals for certain account actions, using Solana’s Ed25519 verification instructions to validate signatures. The attacker allegedly manipulated the second verification step so that data from the first instruction could be reused, allowing one attacker-controlled signature to be accepted as if it were two distinct authorizations.

After bypassing that control, the attacker used administrative functions to grant privileges on targeted accounts and then withdrew USDC and USDT from those collateral balances without customer approval. Blockaid said the exploit operated at the contract level, meaning ordinary wallet protections would not have stopped the unauthorized withdrawals.

Scale of the attack

Blockaid said it found four contract deployments with the same opcode hash as the vulnerable version. At least two were drained, while the other two reportedly had the same flaw but no confirmed losses. The firm recorded 2,945 administrator additions and 5,288 withdrawal calls, for a total of 8,233 core exploit transactions over about two hours and 29 minutes.

The pace suggested automation. Blockaid said the first two successful withdrawals were only three seconds apart, indicating the attacker had prepared a system to process multiple accounts quickly. Rain later confirmed that an outdated contract version was responsible, but it has not published a full technical report naming every affected deployment or explaining why older versions remained active.

Affected programs and customer impact

Avici said $500,859.22 was removed from card balances belonging to 1,685 users. The company said it refunded all affected customers and also offered 10% cashback after the incident. Tria separately disclosed about $431,945 in losses across 636 customers and said each affected customer was being reimbursed.

Together, those statements account for $932,804.22 across 2,321 users. Blockaid also named Solayer Pay as an affected program, though no independently verified loss figure was published for it. That gap appears to explain part of the difference between the disclosed losses and Blockaid’s estimate of roughly $1.1 million across Rain-supported programs.

Rain said affected users would be made whole, but it has not clarified whether reimbursement will come directly from Rain or be handled by the individual card providers.

Fund movements after the theft

Blockaid traced the withdrawn stablecoins to a Solana wallet where the assets were gathered before being swapped into SOL on decentralized trading platforms. The security firm then said the proceeds moved from Solana to Ethereum through the deBridge cross-chain protocol.

On Ethereum, about 455.9 ETH was deposited into Tornado Cash between 19:20 and 19:49 UTC, according to Blockaid. The mixer obscures links between deposits and later withdrawals, making subsequent tracking more difficult through public blockchain data. Blockaid said the funds had not been recovered after reaching Tornado Cash.

The firm also linked two Ethereum addresses to the initial funding of the attacker’s Solana activity, but neither Rain nor law enforcement has publicly identified the individuals behind those wallets.

What happens next

Rain said all programs still using the outdated contract have been upgraded and that it saw no further unauthorized activity after the changes. Even so, several details remain unresolved, including when the flaw was introduced, why older deployments were still in use and whether any prior audit had identified the authorization weakness.

The incident adds to broader concerns around smart contract and operational security. Blockaid research said crypto security failures caused about $1.1 billion in losses in the first half of 2026. For Rain, the next confirmed step is the completed upgrade of affected programs, but a fuller technical disclosure would be needed to let outside researchers verify the root cause and check whether similar vulnerable code remains active elsewhere.