Avici Hack Losses Surpass $1 Million as Stolen Solana Funds Move Through Tornado Cash

Losses from the hack of Solana-based neobank Avici have surpassed $1 million after the attacker moved the stolen assets through Tornado Cash, a crypto mixing service commonly used to obscure transaction trails.

Blockchain security firm Onchain Lens tracked the funds and reported that the hacker address beginning with FVNFzq converted 10,000 $SOL into 1.02 million USDC. The attacker then bridged the assets into 418 ETH before depositing them into Tornado Cash.

The exploit is believed to have involved vulnerabilities in Avici’s smart contract permissions and signature verification systems, although the precise attack method has not been fully disclosed.

How the Avici Attack Unfolded

On-chain data indicates that the attacker first transferred the stolen $SOL from Avici’s smart contract to a personal wallet. Within hours, the funds were exchanged for a stablecoin and bridged to Ethereum, following a laundering pattern frequently seen in cryptocurrency exploits.

The use of Tornado Cash, a privacy protocol sanctioned by the U.S. Treasury in 2022, suggests an intentional effort to make the transactions more difficult to trace. Attackers increasingly use mixing services in decentralized finance exploits to complicate investigations by law enforcement agencies and blockchain analytics firms.

Smart Contract Security Under Scrutiny

Security experts have identified weaknesses in Avici’s smart contract permission controls and signature verification processes as likely entry points. These types of flaws can allow attackers to alter transaction parameters or forge signatures, making unauthorized withdrawals possible.

The incident adds to broader concerns about security across the Solana ecosystem, which has experienced a rise in decentralized finance hacks and exploits over the past year. Solana’s high transaction throughput and low fees have attracted developers, but rapid innovation can sometimes outpace comprehensive security auditing.

What the Avici Hack Means for DeFi Users

The Avici incident highlights the risks faced by users of decentralized finance platforms. Smart contract vulnerabilities can result in the total loss of deposited funds, while the pseudonymous nature of blockchain transactions makes recovery difficult. Recovering assets becomes even more challenging when attackers route them through privacy protocols.

Users should conduct due diligence before depositing assets into any DeFi protocol. This includes reviewing available audit reports, assessing the platform’s security controls, and considering insurance options where available.

Avici Response and Next Steps

Avici has not released an official statement about the hack. Incidents of this kind typically lead to internal investigations and may result in stronger security protocols. In some cases, affected platforms negotiate with attackers for the return of stolen funds, although the use of Tornado Cash may indicate that the attacker does not intend to cooperate.

Law enforcement agencies and blockchain analytics firms are expected to monitor the movement of the stolen assets. However, the anonymity and obfuscation provided by crypto mixing services create significant challenges for tracing and recovery.

FAQs About the Avici Hack

What is Avici?

Avici is a Solana-based neobank that offers digital banking services using blockchain technology. It allows users to manage assets and complete transactions through decentralized applications.

How was the Avici hack executed?

The attacker exploited vulnerabilities in Avici’s smart contract permissions and signature verification systems, enabling unauthorized withdrawals. The stolen $SOL was then exchanged and bridged to Ethereum before being deposited into Tornado Cash.

Can the stolen Avici funds be recovered?

Recovery is highly unlikely because the attacker used Tornado Cash, a mixing service designed to obscure the destination of funds. Although the U.S. Treasury has sanctioned Tornado Cash, tracing assets moved through the service remains extremely difficult.