Rain Exploit Drains $500,859 From Solana (SOL) Card Balances

Outdated Solana Contracts Drained

Rain, the card-issuing infrastructure provider behind crypto neobanks Avici and Tria, disclosed on August 29 that its monitoring systems had uncovered a vulnerability in an outdated version of its Solana contracts — and that an attacker had already used it to drain $500,859.22 from user card balances. The company said the exploit was confined to a small number of programs still running the legacy contract version, while all other programs on its rails were untouched, and that it launched an investigation immediately to determine the full scope. The affected balances worked in a specific way: users deposited stablecoins such as USDC or USDT into a dedicated contract that managed the spendable balance loaded onto their cards, and the attacker targeted the contracts left on the old version, pulling out the card balances held there. Per Tria's disclosure on X, losses were limited to USDC and USDT card balances charged on Solana — user wallets, futures, Earn and EVM-side card balances stayed intact. Avici separately confirmed that 1,685 users were affected, per its official post, noting that user-controlled Solana and EVM wallets were segregated from the card contracts and suffered no losses. On-chain tracing reconstructed the attack sequence: the intruder first invoked SubmitSignatures on Avici's authentication program, then executed AddCollateralAdmin on the collateral-management program, and finally extracted funds through WithdrawCollateralAsset. Markets reacted fast — the project's altcoin AVICI lost roughly 49.4% in 24 hours, sliding to an all-time low near $0.2175 as heavy selling and FUD spread across the tape. Rain states it has already upgraded every program running the outdated contracts, stopping the attack, and will fully reimburse all affected users; third-party forensic specialists are engaged and a technical post-mortem is planned.

Tria's disclosure on Xhttps://x.com/useTria/status/2093433665258963450

Korean Exchange Staking Hits 4.69 Trillion Won

Deposit-style products are also reshaping Korea's exchange landscape. Data submitted to the National Assembly's Policy Committee by Democratic Party Representative Park Min-gyu shows the four won-trading exchanges — Upbit, Bithumb, Coinone and Korbit — held 4.6936 trillion won in staked virtual assets as of end-July, with rewards paid to users averaging about 10.42 billion won per month this year. Staking here means locking assets like Ethereum or Solana into the network's consensus mechanism for protocol rewards — a deposit-style product distinct from yield farming on DeFi protocols. The total fluctuated through the year, from 5.0747 trillion won at end-January down to 4.3288 trillion won at end-June. User adoption moved faster: staking accounts passed 1 million in January, jumping 35.95% in a single month to 1,048,547, and reached 1,225,455 by end-July. The competitive structure also broke Upbit's monopoly. In January, Bithumb's staking users — 462,742 — overtook Upbit's 321,965 for the first time, and Bithumb still leads with a 48.37% share (592,742 accounts) versus Upbit's 29.34% (359,516). By value, however, Upbit remains ahead with 51.78% (2.4305 trillion won) against Bithumb's 43.41% (2.0374 trillion won) — a far narrower gap than the 68.00% dominance Upbit held a year earlier. Notably, Upbit has seen unstaking exceed new staking every month since January 2025 even as Bithumb's user base surged. Upbit's six staking assets currently carry estimated annual reward rates of 2.01% to 19.09%. Tiger Research center head Yoon Seung-sik reads the trend as risk-off behavior: with the market in a slump, users are locking up holdings to collect rewards rather than trading. Korea also has a cautionary precedent — Gopax's GoPay lending service, a similar deposit-style product, effectively shut down in November 2022 after its partner Genesis Global Capital froze redemptions in the wake of FTX's collapse. Readers tracking the market in real time can follow live spot and futures prices on Bybit.

Custody Risk in Yield Products

Taken together, the two stories describe the same structural exposure from opposite ends: any product that pools user assets to generate yield concentrates custody risk. Rain's case is verifiable at the primary-source level — the official statement commits to full reimbursement for all 1,685 affected users, and the on-chain call sequence of SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset documents exactly how the $500,859.22 drain occurred. It also rhymes with June's Raydium incident on Solana, where roughly $1.34 million was pulled from deprecated liquidity pools; in both cases, outdated programs remained live attack surfaces. Our reading at COINOTAG: the reimbursement timeline and Rain's post-mortem — not the headlines — will reveal whether this was a process failure or a design flaw, and Korean deposit-product users should treat the Gopax precedent, not the current reward rates, as the base case for platform risk.