Liquidity evaporation detected. Not from a pool. From a promise.
The attacker's wallet sits at 10,005 SOL and counting. Every block confirms the same grim reality: Avici, the Solana-based neobank that sold itself on "self-custody" and passkey-enabled security, is bleeding customer funds in real-time. Over $1 million gone. No pause. No circuit breaker. Just a two-hour gap between the first unauthorized withdrawal and the team's public acknowledgment that something was wrong.
This isn't a hack. It's a structural failure of an architecture that claimed to eliminate trust while quietly depending on it.
Context: The Neobank That Wasn't
Avici positioned itself at the intersection of two seductive narratives: Solana's high-throughput capabilities and the growing demand for crypto-native banking products. The pitch was elegant โ users deposit cryptocurrency, receive a Visa card, and spend their digital assets anywhere traditional cards are accepted. The twist? Avici claimed users never actually surrendered control. Funds remained in on-chain accounts, secured by passkeys โ the modern passwordless authentication standard built on public-key cryptography.
Metadata mismatch found. The marketing said "self-custody." The architecture said otherwise.
For a neobank operating on Solana, the value proposition was clear: bypass the sluggishness of traditional banking while maintaining the convenience of a card. No seed phrases to lose. No centralized exchange to trust. Just biometric authentication and a Visa card in your digital wallet. The user experience was the product, and passkeys were the differentiator that supposedly eliminated the single most significant barrier to mainstream crypto adoption โ key management.
But here's what the pitch deck didn't mention: passkeys protect the user's device, not the protocol's backend. And when an attacker drains funds continuously without triggering any automated response, the problem isn't the user's phone. It's the system that allowed unauthorized withdrawals to occur in the first place.
The timeline is damning. First unauthorized transaction detected. Then more. Then a flood. Avici's team needed nearly two hours to "realize" there was an issue affecting card balance withdrawals. For a financial application processing user funds, two hours is an eternity. In that window, the attacker systematically extracted over a million dollars.
Pattern emerging from chaos. The attack wasn't a single exploit. It was a sustained, methodical extraction.
Core: Deconstructing the "Self-Custody" Illusion
Let me be precise about what happened here, because the technical details matter more than the headline numbers.
Avici's core claim was that user funds reside in on-chain accounts, accessible only through passkey authorization. Passkeys use asymmetric cryptography โ the private key never leaves the user's device, and authentication requires biometric verification or device PIN. This is genuinely strong security for the user endpoint. Breaking a passkey requires physical access to the device or a sophisticated supply-chain attack on the hardware itself.
So how did an attacker drain over $1 million?
The answer is almost certainly not "they broke individual passkeys." That would require compromising multiple users' devices simultaneously โ an operationally absurd attack vector. The far more plausible explanation: the attacker compromised Avici's backend infrastructure, not user endpoints.
This is the uncomfortable truth that Avici's architecture was designed to obscure. For a "self-custody" system to function, there must be a mechanism for the protocol to interact with user funds. Someone needs to construct transactions, broadcast them, and manage the interaction between the user's passkey and the on-chain account. That's typically handled by a relayer, a transaction-signing service, or a backend API that coordinates the entire flow.
Fork in the road ahead. Either Avici's backend signing keys were compromised, or their smart contract contained a privilege escalation vulnerability that allowed unauthorized addresses to withdraw user funds.
Let me walk through both scenarios, because they lead to different conclusions about the severity of this breach.
Scenario One: Backend Key Compromise
If Avici operated a centralized signing service โ a server holding private keys that could authorize transactions on behalf of users โ then compromising that server gives the attacker a master key to every user's funds. This is the classic "self-custody theater" problem. The user interface might require a passkey, but if the backend can sign transactions without that passkey, the entire security model collapses.
This scenario is consistent with the attack pattern. The attacker didn't need to target individual users. They found one vulnerability, exploited it, and gained access to a privileged signing path that allowed continuous withdrawals.
Scenario Two: Smart Contract Vulnerability
Alternatively, Avici's on-chain contracts may have contained a logic flaw โ perhaps in the withdrawal function, perhaps in the account abstraction layer, perhaps in the interaction between the passkey verification module and the actual fund transfer logic. If the contract failed to properly validate the caller's authorization, an attacker could invoke withdrawal functions directly, bypassing the passkey requirement entirely.
This scenario is equally damning. It means Avici deployed contracts to mainnet without adequate security review, or with a known vulnerability that was never addressed.
The Response Failure
Here's what makes this worse than a typical DeFi exploit: the two-hour detection gap.
Modern security operations centers monitor transactions in real-time. Anomaly detection systems flag unusual withdrawal patterns within seconds. Automated circuit breakers pause withdrawals when thresholds are exceeded. Avici had none of this. The first unauthorized transaction should have triggered an immediate response. Instead, the attacker operated freely for nearly two hours.
Based on my experience auditing financial protocols, this indicates a fundamental absence of security operations infrastructure. No real-time monitoring. No automated safeguards. No incident response playbook. For a project handling user funds, this is not an oversight โ it's a systemic failure.
The deeper issue is architectural. Avici's "self-custody" model required a centralized component to function โ a relayer, a signer, an API gateway. That centralized component became the attack surface. The passkey was a user-facing feature that created the illusion of security while the actual security perimeter was a traditional, vulnerable backend server.
This is the pattern I've seen repeatedly in crypto: projects that market "non-custodial" or "self-custody" solutions while maintaining privileged access paths that undermine the entire premise. The marketing isn't necessarily malicious โ but it's misleading. And when the privileged path is compromised, users discover that their "self-custody" was always conditional on the project's backend security.
Contrarian: The "Self-Custody" Narrative Was Always a Liability
Here's the angle nobody wants to discuss: Avici's "self-custody" positioning may have made this attack worse, not better.
Consider the alternative. If Avici had been transparent about operating a custodial model โ with proper cold storage, insurance, and institutional-grade security โ users would have had clearer expectations about the risks. The project could have implemented robust safeguards: multi-signature withdrawals, daily limits, delayed transfers, insurance coverage.
Instead, the "self-custody" narrative created a false sense of security. Users believed their funds were protected by cryptography they controlled. In reality, their funds were protected by Avici's backend security โ which failed catastrophically.
This isn't just an Avici problem. It's an industry-wide pattern. Projects increasingly market "self-custody" because it's a compelling narrative โ it resonates with crypto's foundational ethos of individual sovereignty. But true self-custody requires the user to control the entire transaction flow. The moment a project introduces a relayer, a signer, or any intermediary that can move funds without user authorization, it's no longer self-custody. It's custodial with extra steps.
The regulatory implications are significant. If Avici marketed itself as self-custodial while maintaining backend signing capabilities, it may have engaged in misleading advertising. More critically, if it held user funds in a manner that allowed the project to control withdrawals, it may have been operating as an unlicensed money transmitter or custodian โ a serious regulatory violation.
The Howey test analysis is equally concerning. Users deposited assets with the expectation of profit (card spending convenience, potential rewards). The funds were pooled and managed by Avici's team. Profits derived from the efforts of others. This pattern has historically been treated as an investment contract โ which would require SEC registration.
The industry-wide damage is the real story here.
Every project that markets "self-custody" while maintaining backend control is now under a microscope. Every neobank, every card issuer, every wallet with a "recovery" feature. The Avici incident provides regulators with a concrete example of the gap between marketing claims and technical reality.
For Solana specifically, this is another blow to the ecosystem's credibility. Solana has worked hard to shed its reputation for network outages and technical instability. A high-profile security failure in a flagship financial application reinforces the perception that the ecosystem prioritizes speed over security.
Takeaway: The Trust Architecture Must Be Rebuilt
The attacker's wallet still holds 10,005 SOL. The funds are still moving. Avici's future is uncertain at best.
But the broader lesson is clear: "Self-custody" is not a marketing term. It's a technical commitment.
Projects that claim self-custody must be prepared to prove it โ through transparent architecture, verifiable smart contracts, independent audits, and real-time monitoring. If a project maintains any privileged access path, it must disclose that fact and implement appropriate safeguards.
The market is already responding. Users are withdrawing funds from similar platforms. Competitors with stronger security track records are positioning themselves as safer alternatives. Insurance providers are seeing increased demand. The "self-custody" narrative is entering a period of intense scrutiny.
Fork in the road ahead. The question isn't whether Avici survives โ it's whether the industry learns from this failure.
Will we see a shift toward verifiable security? Will projects compete on audit quality and insurance coverage rather than marketing narratives? Will regulators step in to define what "self-custody" actually means?
The next six months will answer these questions. But one thing is certain: the era of "self-custody theater" is over. Users have seen the curtain pulled back, and they won't forget what's behind it.
The attacker's wallet is still active. The funds are still flowing. And the industry is still watching.