Rain exploit analysis

On 28 August 2026, a vulnerability in a smart contract belonging to Rain, a crypto payments infrastructure provider, caused $1.1 million in losses across several of the neobanks that use Rain's card-spending infrastructure. Customers of the Avici cryptocurrency neobank, which offers a Visa credit card through which customers can spend their crypto in real-world transactions, suffered roughly $500,000 in losses. Customers of another neobank, Tria, lost more than $430,000. The losses stood out for what they said about the limits of self-custody marketing.

The mechanism was a flaw in the card-spending contract. Self-custodial neobanks usually argue that customer funds are safer in user wallets than on a centralised exchange, because no third party holds them. That argument assumes the user controls the keys and approves transactions. In the card-spending flow, however, customers had to load the funds they wanted to spend into a third-party contract managed by the card issuer. That contract had the authority to debit balances as the customer swiped. When the contract was exploited, every user who had pre-loaded funds became a victim by design, not by accident. CoinDesk's headline that an "AVICI token" had crashed 49% refers to the price impact on the Avici neobank's governance token, not the asset customers were holding.

The figures are partial and the reporting was unsettled at the time. CoinDesk's account described "$1.1 million" in losses across multiple firms. The Defender account said Avici users had suffered "over $1M". BeInCrypto put Avici's loss at $650,000. Crypto Briefing reported $600,000 drained from Avici's card balances specifically. The web3isgoinggreat account splits the $1.1 million as roughly $500,000 from Avici and over $430,000 from Tria. The numbers describe the same exploit and the same week, but they do not agree on the per-firm breakdown.

The response was uneven. Avici confirmed full refunds for its affected users in the days after the attack, which is unusual in this class of incident. Many similar exploits leave customers holding the loss. Tria's response was less visible. The Avici token's price recovered substantially after the refund announcement, on speculation of a MoonPay partnership.

Compared with the other 2026 incidents in the corpus, the Rain case is interesting less for its scale than for what it shows about the limits of "self-custodial" branding. Several similar neobank and card-platform projects use the same architecture: user balances sit in a contract that the card issuer can debit on swipe. When the contract is sound, the architecture delivers the convenience of a debit card with the sovereignty of a wallet. When the contract is exploited, every pre-funded user is drained simultaneously. The Rain exploit is a worked example of how the second case arises by design rather than by accident.