Rain contract exploit drains $1.1M from card users

An attacker exploited an outdated Rain card contract on Aug. 28, draining approximately $1.1 million from multiple stablecoin card programs operating on Solana, according to blockchain security company Blockaid. Summary An outdated Rain Solana contract allowed unauthorized withdrawals from card collateral accounts across multiple programs. Blockaid estimated approximately $1.1 million was stolen, with proceeds later entering Tornado Cash on Ethereum. Avici reported $500,859 drained from 1,685 users, while Tria identified $431,945 affecting 636 customers separately. Rain said every program using the vulnerable contract version was upgraded following the August attack. Self-custodial wallets remained unaffected because the attacker targeted separate contracts holding funded card balances instead. Avici and Tria were among the affected crypto neobanks. The two companies disclosed combined losses of more than $932,800 across 2,321 users. Blockaid said other Rain-supported programs were also exposed, bringing the estimated loss to approximately $1.1 million. The attacker did not access customers’ self-custodial wallets or private keys. Instead, the exploit targeted collateral contracts ...