A vulnerability in an outdated Solana smart contract used by crypto card infrastructure provider Rain has resulted in unauthorized withdrawals exceeding $930,000 across at least 2,321 users, according to disclosures from two affected platforms.

The incident, which began on Aug. 28, exposed a critical weakness in the bridge between self-custodial wallets and card balance contracts. While users’ personal wallets remained untouched, funds moved into card-specific contracts became vulnerable to exploitation.

Avici, a Solana-focused financial app, reported the largest impact: 1,685 cardholders lost a combined $500,859.22. The company said its standard Solana wallets and EVM-compatible wallets were not compromised. Tria, another platform…