Crypto neobank Avici is confronting what appears to be an ongoing security incident, as on-chain data indicates that more than $1 million has left card collateral accounts on its Solana-based platform. The figures were highlighted in a recent post by @coinbureau on X.

Card collateral accounts are a common design in crypto spending platforms: users lock up cryptocurrency as backing for a issued card's spending limit, which means any unauthorized drainage of those accounts can directly affect the assets users have committed to the service. Avici operates on Solana, a network whose public ledger makes such fund movements observable in real time.

The reported activity has coincided with a sharp decline in Avici's native $AVICI token, which has fallen 49% to a record low. Separately, fake websites impersonating Avici have reportedly stolen another $600,000 from users.

Avici has acknowledged an issue affecting card balance withdrawals but has not confirmed that the incident resulted in a loss of funds, nor has it described the activity as an exploit.

More Than $1 Million Leaves Avici Card Accounts

According to information shared by @coinbureau, on-chain data shows that more than $1 million has exited card collateral accounts associated with Avici. The transactions have raised concerns about the platform's security and whether unauthorized withdrawals may still be taking place. The wallet identified in connection with the reported activity was funded through deBridge, a cross-chain bridge used to transfer assets between blockchain networks. Cross-chain bridges have repeatedly appeared in past crypto security incidents as a channel for moving assets between networks, though their use alone does not indicate wrongdoing.

Fund movements on a blockchain can be tracked publicly, allowing analysts to observe transaction activity and follow the flow of assets between addresses. However, blockchain data alone cannot establish who controls a wallet or definitively prove that a particular address belongs to an attacker. The reported transactions therefore provide evidence of significant fund movement but do not, by themselves, establish the complete circumstances behind the withdrawals.

Avici Acknowledges Issue With Card Withdrawals

Avici has confirmed that it is aware of an issue affecting card balance withdrawals, but the company has stopped short of confirming a financial loss or classifying the situation as an exploit. That distinction leaves the precise nature of the incident unresolved.

An unusual transaction involving a cryptocurrency platform does not necessarily establish that the underlying system has been compromised. Confirming an exploit would generally require evidence that an unauthorized party gained access to funds or infrastructure and used that access to conduct transactions. In Avici's case, the company's public statement confirms a withdrawal-related issue exists, while the on-chain activity cited by @coinbureau has provided additional visibility into the movement of funds.

Further information from Avici would be needed to determine whether the reported withdrawals were authorized, how the affected accounts were accessed, and whether users ultimately suffered losses.

$AVICI Token Drops 49%

The reported incident has been accompanied by a significant decline in the market value of Avici's native token. According to the report, $AVICI has fallen 49% to a record low as concerns surrounding the platform's withdrawal system and the reported movement of funds emerged.

Cryptocurrency markets can react quickly to reports involving security incidents, particularly those involving platforms that provide financial services or manage user assets. However, a sharp decline in a token's price does not independently confirm the nature or financial consequences of an underlying security incident. In this case, the 49% decline represents a substantial market reaction occurring alongside reports of unusual fund movements and an acknowledged withdrawal issue.

Fake Avici Websites Reportedly Steal $600,000

The reported security concerns extend beyond the activity involving Avici's card collateral accounts. According to @coinbureau, fake Avici phishing websites have reportedly stolen another $600,000 from users. These fraudulent websites appear to have been designed to impersonate the legitimate Avici platform. Phishing schemes typically attempt to deceive users into interacting with malicious websites or providing information and transaction authorization to unauthorized parties.

Fraudulent impersonation sites frequently proliferate while a platform is in the news over security concerns, when users searching for official statements may be directed to look-alike domains. Verifying domains against Avici's official channels is a standard precaution users can take, though the reported losses here occurred before or alongside such awareness.

The reported $600,000 in phishing losses is separate from the more than $1 million that reportedly left Avici's card collateral accounts. This distinction matters because the two incidents involve different mechanisms: the first concerns transactions associated with Avici's platform, while the second involves users allegedly being targeted through fraudulent websites.

Full Scope of Incident Remains Unclear

The precise scope of the Avici incident has yet to be established. On-chain data can show where cryptocurrency moves and when transactions occur, but it cannot independently determine whether those transactions were authorized by a platform or its users. That requires information from the company and, where applicable, further investigation.

Avici has acknowledged the withdrawal issue but has not confirmed a loss or referred to the situation as an exploit. Meanwhile, the data highlighted by @coinbureau points to more than $1 million in reported fund movements, while separate phishing activity has allegedly resulted in another $600,000 in losses. The $AVICI token's 49% decline to a record low adds another consequence to the unfolding situation, although the token's market performance does not establish the cause of the reported withdrawal activity.

Further updates from Avici will be important in determining the nature of the incident, the amount of funds ultimately affected, and whether the reported transactions were unauthorized. Until those details are confirmed, the reported activity remains an apparent security incident rather than a conclusively established exploit.