A security flaw in a legacy smart contract led to a $1.1 million theft from Solana-based crypto card platforms, mainly affecting neobanks Avici and Tria. Avici lost $500,800 impacting 1,685 cardholders, while Tria lost over $430,000 affecting 636 users. The stolen stablecoins were converted to SOL, moved to Ethereum, and laundered through Tornado Cash. Both companies pledged full reimbursement to customers, with Avici filing a complaint to federal authorities. The incident highlights risks in third-party contract custody despite secure user wallets and occurs amid growing crypto card usage.