At block height 315,482,119, the Solana ledger recorded something that should not exist. An address with no prior interaction history with Avici's smart contracts initiated a withdrawal from a user's on-chain account. Not a test transaction. Not a gas optimization. A full drain. By the time the attacker's wallet accumulated 10,005 SOL—roughly $1.1 million at current prices—the neobank had yet to pause a single transaction. The exploit wasn't sophisticated. It was structural.
The Context: What Avici Claimed to Be
Avici positioned itself as the bridge between crypto-native self-custody and traditional card payments. Users deposit collateral into on-chain accounts, authorize transactions via Passkeys—the FIDO2 standard replacing passwords with biometric or device-based authentication—and spend through a Visa card. The pitch was elegant: your keys, your crypto, your spending power, all wrapped in a familiar payment rail.
The architecture, on paper, follows a pattern I've audited dozens of times since 2021. A smart contract holds user funds. A Passkey-based authentication layer signs withdrawal intents. A relayer network submits signed transactions to the Solana network. The user maintains the private key on their device, never sharing it with the server. This is the standard "non-custodial with convenience" model that emerged after the 2020 DeFi summer taught us that seed phrases are the single largest UX bottleneck in crypto adoption.
But here's the problem I've flagged repeatedly in my audits: the moment you introduce a relayer or a signing service, you've created a privileged execution path. The question isn't whether that path exists—it always does. The question is whether it's properly isolated, monitored, and constrained.
Avici's response timeline tells us the answer. The first unauthorized withdrawal occurred at approximately 14:30 UTC. Avici acknowledged the issue at 16:22 UTC—nearly two hours later. In that window, the attacker systematically drained multiple accounts, suggesting either a scripted exploit or a compromised backend service with continuous access.
The Core: Tracing the Privilege Escalation
Let me walk through the technical possibilities, because understanding what likely happened is more valuable than the headline numbers.
Possibility One: Compromised Relayer Infrastructure
The relayer is the most obvious attack surface. In standard implementations, the relayer holds a hot wallet with limited permissions—enough to submit transactions but not to authorize them. However, I've seen implementations where the relayer also holds a "recovery key" or "admin override" for customer support purposes. If Avici implemented such a backdoor—and the two-hour response time suggests they had no real-time monitoring on this path—the attacker who compromised the relayer's signing key could authorize withdrawals without any user interaction.
The math here is straightforward. Passkeys use asymmetric cryptography. Each user's private key resides in their device's secure enclave. Compromising individual Passkeys would require physical access to each device or a sophisticated supply-chain attack on the FIDO2 implementation itself. The probability of that happening across multiple accounts simultaneously is negligible. A single compromised backend key, however, explains everything.
Possibility Two: Smart Contract Logic Flaw
The alternative is a vulnerability in the withdrawal logic itself. Perhaps the contract failed to properly validate the authority field against the Passkey-derived public key. Perhaps there was a reentrancy vector in the settlement function. Perhaps the contract allowed batch withdrawals without per-account authorization.
I've seen this pattern before. In 2022, I audited a "self-custody" wallet that allowed the update_authority function to be called by anyone who could provide a valid signature from any previously authorized key—including keys that had been rotated out. The developer had assumed that old keys would be invalidated automatically, but the contract didn't enforce that invariant.
Possibility Three: The Passkey Verification Bypass
The most concerning possibility is a flaw in how Avici integrated Passkey verification. The FIDO2 standard is robust, but its implementation in blockchain contexts often involves a verification contract that maps Passkey signatures to Solana public keys. If that mapping logic contained a flaw—say, accepting a signature from any registered device rather than the specific device associated with the account—an attacker who compromised even one device could drain multiple accounts.
The common thread across all three possibilities is the same: Avici's "self-custody" claim was architecturally false. The moment you introduce a relayer, a recovery mechanism, or a verification service, you've created a trusted third party. The user's funds are no longer solely controlled by their private key. They're controlled by the intersection of their key and the backend's integrity.
This isn't a novel insight. I wrote about this exact structural weakness in my 2023 analysis of smart contract wallets, tracing the gas limits back to the genesis block of the account abstraction debate. The industry has known for years that "self-custody with convenience" is a spectrum, not a binary. What Avici did was market the most convenient end of that spectrum as if it were the most secure.
The Contrarian Angle: The Real Vulnerability Was the Narrative
Here's what the market will miss in the aftermath: the exploit didn't break Avici's security model—it revealed that the model was never what was advertised.
The "self-custody" narrative has become a marketing checkbox rather than a technical guarantee. Projects slap the label on their landing pages because it's what VCs want to hear and what users have been trained to demand. But the actual architecture often includes admin keys, upgrade mechanisms, and recovery paths that exist precisely because pure self-custody is operationally impossible for a consumer product.
Let me be precise about what I mean. A truly self-custodial system has one and only one way to move funds: a signature from the user's private key. No exceptions. No recovery. No admin override. If you lose your key, your funds are gone. That's the deal.
Avici couldn't operate that way. A Visa card requires chargeback handling. Chargebacks require the ability to reverse transactions. Reversing transactions requires a privileged path. So they built one. And that privileged path was compromised.
The uncomfortable truth is that every "self-custody" neobank has this same structural vulnerability. The only difference is whether the privileged path is properly secured, monitored, and insured. Avici's two-hour response time suggests they weren't monitoring it at all.
This is the lesson that will be lost in the post-mortem. The market will focus on the specific exploit vector—was it the relayer? The contract? The Passkey integration?—and will miss the systemic issue. The self-custody narrative in consumer finance is a contradiction in terms. You can have self-custody, or you can have a Visa card with chargeback support. You cannot have both without introducing a trusted intermediary.
The Market Impact: Beyond Avici
The immediate impact is clear: Avici users are out at least $1.1 million, and the attacker's wallet is still active. The project faces an existential crisis. But the ripple effects extend far beyond this single project.
For Solana, this is another data point in a troubling pattern. The network has worked hard to shed its "downtime chain" reputation, and it has made genuine progress on that front. But security incidents on top-tier applications—and Avici was positioned as a flagship consumer finance product—undermine the broader narrative that Solana is ready for mainstream financial adoption. Institutional investors who were considering Solana-based products will now ask harder questions about the security posture of the applications they're evaluating.
For the RWA and neobank narrative, this is a significant setback. The tokenization of real-world assets and the emergence of crypto-native banking services have been two of the most compelling stories in this cycle. Avici's failure will be cited by skeptics as evidence that these models are fundamentally unsafe. The counterargument—that Avici's implementation was flawed, not the concept—will be drowned out by the headline numbers.
For competitors, this is a window of opportunity. Projects with verifiable security track records, transparent audit histories, and actual insurance coverage will have a compelling story to tell. The question is whether they can tell it before the market's attention shifts to the next narrative.
The Regulatory Dimension
The regulatory implications are potentially more significant than the market impact. Avici's "self-custody" marketing claim, combined with the reality that funds were drained through a non-user-authorized path, raises serious questions under multiple regulatory frameworks.
In the United States, the Howey test analysis is straightforward. Users deposited assets with the expectation of profit (card rewards, potential appreciation), into a common enterprise (Avici's pooled infrastructure), with profits derived from the efforts of others (Avici's team managing the platform). If a court applies this framework, Avici's product could be classified as a security. The "self-custody" claim doesn't negate this analysis—it potentially makes it worse, because it suggests the project was misleading users about the nature of their relationship with the platform.
The consumer protection angle is even more direct. The Federal Trade Commission and state financial regulators have jurisdiction over deceptive marketing practices. If Avici told users their funds were self-custodied when they were actually accessible through a backend service, that's a textbook case of misleading advertising. The two-hour response time compounds the issue—it suggests the project lacked basic safeguards that would be expected of any financial services provider.
The Visa partnership is another vulnerability. Visa has strict security and compliance requirements for its partners. A security incident of this magnitude, combined with evidence of misleading marketing, could trigger a review of Avici's card program. If Visa pulls the plug, Avici's business model collapses entirely.
The Operational Failures
Let me focus on the operational failures, because they're the most instructive for other projects.
The two-hour detection gap is indefensible. For a financial application handling user funds, real-time monitoring is not optional. It's the baseline. The fact that Avici didn't detect the first unauthorized withdrawal until nearly two hours later suggests they had no automated anomaly detection, no transaction monitoring, and no alerting system. This is the kind of operational negligence that regulators will not ignore.
The lack of a kill switch is equally concerning. When the first unauthorized withdrawal was detected, Avici should have been able to pause all withdrawals and card transactions within seconds. Instead, the attacker continued draining funds. This suggests either no pause mechanism existed, or the team didn't know how to activate it.
The communication strategy was reactive and inadequate. Avici's acknowledgment that it was "aware of the issue" came two hours after the first theft, and the statement provided no actionable guidance for users. In a crisis of this magnitude, users need immediate, clear, and actionable information. Avici provided none of that.
The Industry-Wide Implications
This event should be a wake-up call for the entire crypto-finance sector. The composability of DeFi protocols is a double-edged sword for security—the same interoperability that enables innovation also creates systemic risk. When a neobank like Avici fails, it doesn't just affect its own users. It affects the perception of every project in the ecosystem.
The "self-custody" label has been devalued. After this incident, users will be rightfully skeptical of any project that claims self-custody without providing verifiable proof. The burden of proof has shifted. Projects will need to demonstrate, through code audits, formal verification, and transparent architecture, that their self-custody claims are real.
The insurance market will grow. This incident will accelerate the adoption of smart contract insurance and custodial insurance products. Projects that can demonstrate insurance coverage will have a competitive advantage in attracting users who are now more risk-aware.
The audit industry will face scrutiny. Avici presumably had audits—most projects do. The question is whether those audits covered the critical withdrawal paths and the backend infrastructure. If they didn't, the audit industry needs to expand its scope. If they did, the audit industry needs to explain how this exploit was missed.
The Path Forward
For Avici, the path forward is narrow but not impossible. The project needs to:
- Stop the bleeding immediately. Pause all withdrawals and card transactions. This should have happened hours ago.
- Conduct a transparent, independent audit. Hire a reputable third-party firm to conduct a full forensic analysis of the exploit. Publish the results in full.
- Compensate affected users. This is non-negotiable. Whether through insurance, treasury funds, or a recovery token, users need to be made whole.
- Rebuild trust through verifiable security. If Avici survives, it needs to demonstrate—not claim—that its security model has been fundamentally redesigned.
For the broader industry, the lessons are clear. Self-custody is not a marketing term. It's a technical guarantee that requires architectural discipline. The moment you add convenience features, you add attack surface. The moment you add attack surface, you need monitoring, insurance, and a kill switch.
The Takeaway: What This Means for the Next Cycle
The Avici incident will be studied for years as a case study in the gap between narrative and architecture. But the more important question is what it means for the next wave of crypto-finance products.
The market is moving toward a more mature understanding of custody. The binary "self-custody vs. custodial" framing is giving way to a spectrum that includes multi-sig arrangements, threshold signatures, and insurance-backed custody. The projects that thrive will be those that are honest about where they sit on that spectrum and build their security models accordingly.
The regulatory environment is tightening. Incidents like this accelerate the regulatory timeline. The question is no longer whether regulators will act, but how. Projects that proactively embrace transparency and security will be better positioned to navigate the regulatory landscape.
The user experience trade-off is real. The most secure system is the one where users have full control and full responsibility. The most convenient system is the one where a trusted third party handles everything. The industry needs to find a middle ground that offers both security and usability without pretending the trade-off doesn't exist.
I've been analyzing these structural weaknesses since my early audits of state channel implementations in 2017. The specific technologies change—Raiden became Optimism, state channels became ZK-rollups, seed phrases became Passkeys—but the fundamental tension remains. Every abstraction layer introduces a new trust assumption. Every trust assumption is a potential attack vector.
The Avici exploit isn't a bug. It's a feature of the architecture. And until the industry internalizes that lesson, we'll keep seeing the same headlines with different names attached.
The attacker's wallet still holds 10,005 SOL. The funds are still moving. The story isn't over. But the lesson is already clear: in crypto, the most dangerous words are "self-custody" and "trust us." They should never appear in the same sentence.