Avici Drainer Turns $190 Into $670K Before Team Refunds Users

CoinGecko data shows around $190 bought the attacker access. That was the gas bill, the transaction fee, the person paid before walking out of the Solana-based Avici protocol with roughly $670,000, according to Coinpedia. In all, more than $1 million in user funds were exposed in the security breach. The air traffic control protocol, built on the Solana network, makes its money managing intents, off-chain orders that settled through its relayers. The attack appears to have targeted that settlement layer, letting the attacker seize funds before they reached their intended destination.

The attack vector

The scale of the loss is a function of how cheap the exploit was to run. Coinpedia reports the attacker spent around $190 on gas before draining the balance, a cost-to-reward ratio that security researchers flagged as unusual even for a breaking incident. The exact vulnerability class, whether a flaw in intent settlement, a relayer misconfiguration, or a compromised signer, has not been confirmed publicly. What is clear is the time chain. The drain shows up as a series of transactions on Solana, the network where the protocol runs, with SOL serving as the settlement asset. per CoinGecko, at 14:00 UTC Aug 29, CoinGecko has SOL at $105.08, up 2.54% in 24 hours and 11.00% over seven days

The 10% cashback refund

The Avici team moved to make users whole. Per the Coinpedia report, it is offering a 10% cashback refund to those affected by the exploit. The number is worth parsing: a trader who lost $1,000 gets back $100, a partial recovery that leaves the bulk of the loss with the user. The refund path matters as much as the percentage. Figures from the desk show whether users recover in SOL, in the stablecoin pegged to the affected positions, or in a newly issued claim token will determine how much of that 10% is actually recoverable in market value. As of publication, the team has not detailed the distribution mechanism, only the cashback level.

Where the funds went

CoinGecko data shows the attacker's haul of about $670,000 split from the roughly $1 million in total exposure. That gap, the difference between what was drainable and what was drained, suggests the exploit was stopped mid-flight, either by the team pausing the protocol or by the funds sitting in a position the attacker could not reach. On-chain observers noted the money moved in a pattern consistent with a quick exit: withdrawals in size, then a consolidation into a single wallet before any mixing or exchange deposit. Because Avici settles on Solana, every step of that path is public on the network's ledger.

What this means for Solana intents

Avici is not alone in running this design. The intent-based model, where users express what they want and relayers figure out how to get it done, has spread across Solana's DeFi stack, and the attack raises a question for every protocol running it: who is liable when the settlement layer fails? The answer is embedded in the refund offer. per CoinGecko, a 10% cashback is a recognition of responsibility without full restitution, a stance that hands risk back to users for anything above that level. Figures from the desk show the exploit also lands within a live long-tail of concern for traders searching why Solana DeFi exploits happen, at a moment when SOL itself is up 11% on the week, trading on protocol momentum rather than this incident. The open question is the investigation timeline. Whether the drained funds surface at the exchange the consolidating wallet used, and whether the attacker returns any portion, will be settled on-chain, in public, in the days ahead.