Solana-based protocol Avici is facing a continued exploitation attack that has drained more than $1 million from users through compromised collateral accounts, the protocol acknowledged within two hours of the first theft on August 29.
The attack targeted authorization programs that control user collateral, according to on-chain data and independent verification. Avici operates as a banking protocol on Solana, allowing users to deposit collateral and access credit facilities. The breach exposed a weakness in how the protocol manages account permissions, enabling attackers to drain funds across multiple user positions.
Avici disclosed the incident publicly after detecting the first unauthorized transfers. The protocol did not immediately halt all withdrawals or pause operations, leaving additional user accounts vulnerable as the attack continued. Solana-based DeFi protocols have faced repeated authorization exploits over the past 18 months, often stemming from flawed permission checks that allow third-party programs to move user funds without explicit per-transaction approval.
The $1 million figure represents confirmed losses across identified compromised accounts. Attackers typically move stolen funds rapidly across multiple wallets and bridges to obscure their trail. Avici users reported discovering unauthorized transfers hours after the initial breach began, with some accounts completely emptied of collateral.
Solana's transaction speed and low fees have made the network attractive for lending and banking protocols. Competing protocols like Marinade and Lido have implemented additional authorization safeguards in recent months following similar incidents, requiring multi-step confirmation for large collateral movements.
Avici has not announced compensation mechanisms or a timeline for resuming normal operations. The number of compromised accounts exceeds ten, indicating the attack vector remained open for a sustained period. Avici must publish a complete postmortem detailing which authorization checks failed and how it will prevent similar exploits before user confidence in the protocol stabilizes.
