$1.1M Rain Ecosystem Exploit: How Onchain Monitoring Gives Stablecoin Card Issuers Fleet-Level Coverage

Executive Summary

On August 28, 2026, an attacker drained user card balances from multiple stablecoin card programs, including consumer neobanks, built on Rain, the card-issuing infrastructure provider. Users of these programs top up funds into an onchain collateral contract that backs their card spending, and it was that contract, not users' own wallets, that the attacker emptied. A flaw in an outdated version of Rain's Solana card contract made it possible for the attacker to grant itself withdrawal rights over user collateral accounts and drain them account by account, across every program running that contract version.

Blockaid detected the attack as it unfolded, within seconds flagging the attacker's wallet as malicious across our customer network, along with the Ethereum addresses that funded it. As the drain propagated, Blockaid traced the stolen funds through a chain of swaps and a cross-chain bridge into Tornado Cash, and published a live ecosystem alert so that our customers were informed. The stolen funds, roughly $1.1 million in total across the affected programs, reached the mixer and were not recovered. Rain has since confirmed the root cause and upgraded the contract across all of its programs.

This report breaks down how the exploit worked, how the funds moved, and how Blockaid identified and tracked the attacker. It also examines why this class of failure is a category risk for stablecoin card infrastructure and for the neobanks that build on it. Any organization that holds user balances in an onchain card contract, or that runs onchain authorization logic behind card spending, carries the same exposure. Managing that risk is a fleet-level problem. It requires knowing which programs run which contract version, seeing every deployment of the same code, and catching exploit behavior in its first transactions, the coverage that Onchain Monitoring provides.

Rain’s Ecosystem and Where Stablecoin Card-Balance Risk Lives

A stablecoin card lets someone spend digital dollars anywhere ordinary cards are accepted. Behind the familiar tap or swipe, the card networks run the same authorization, clearing, and settlement steps they always have. The difference sits in the back office. Instead of a bank account funding each purchase, the card program checks that the user has enough spending power onchain and settles with the network in stablecoins.

Rain pioneered this model and, as one of the leaders in this space, provides the infrastructure that many card programs run on. Rain holds principal memberships with Visa and Mastercard and settles directly in stablecoins.

For that model to work, a user's spending power has to live somewhere the card program can draw against. In practice, users top up funds into an onchain contract that holds their card balance or collateral. This is a different place from the self-custody wallet a user controls with their own keys. Once money moves from a personal wallet into a card-balance contract, the safety of those funds depends on the card infrastructure rather than on the user's signing habits. A user can hold their own keys and still have their card balance sit in a contract governed by someone else's code. That distinction is exactly where this incident happened.

The Exploit: How it Unfolded

1. An outdated contract version was still live. Rain's card infrastructure runs as an onchain contract deployed per card program, and newer versions of that contract were already in use across Rain's fleet. A small number of programs were still running an outdated version, and that version carried the flaw. Per Rain's public statement, every deployment still on the affected version was upgraded after the incident.

2. User funds sit in a shared card-balance contract. Users of the affected programs topped up stablecoins into a Solana card-balance collateral contract deployed by Rain. The program drained in this incident ran the outdated version, deployed at 26DkA98jjctzPkBEteUsN935CR4dsKx3XvjrtE7MeL4a. Blockaid's bytecode analysis found the same contract, byte for byte, behind three more deployments sharing an identical opcode hash:

• CWgkFB7ngUc9cGD1LryyhP7h6xYWtwrAjhSKKCoR1gkz
• 3zVB27Gap6fbxpAcV2hsBBUcV3vRjkCikBXREiyBzDuc
• 8r2jms1vAnHhtCWxDNSgiHvQNSzzJvGa9oBRCbBPCBNN

Of the four deployments running this contract, the attacker drained at least two. The others remained live with the same bug, exposed in the same way, with no confirmed losses.

3. A reused signature bypasses authorization. The contract relied on Solana's Ed25519 signature-verification instructions to prove that an account action was authorized, and each withdrawal was meant to carry two independent, valid authorizations. In the exploit transactions, the second verification instruction pointed its signature, public key, and message offsets back to the first instruction, so a single attacker-controlled signature stood in for two. The outdated contract accepted that reused proof as sufficient authorization.

4. The attacker grants itself admin over user accounts. Using that bypass, the attacker called AddCollateralAdmin to add itself as an administrator on a victim's collateral account, with no signature from the account's actual owner. It then repeated this across user accounts programmatically.

5. Collateral is drained account by account. With admin rights in place, the attacker called WithdrawCollateralAsset to move USDC and USDT out of each account into a single wallet, FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj. This ran at automated speed across thousands of accounts. Blockaid's indexing recorded 2,945 AddCollateralAdmin calls and 5,288 WithdrawCollateralAsset calls, 8,233 core exploit transactions in total, over roughly two hours and 29 minutes, with the first two successful drains landing three seconds apart. A representative transaction shows the full pattern.

6. The funds were swapped, bridged, and mixed. The attacker swapped the stolen stablecoins for SOL on Solana decentralized exchanges, bridged the proceeds to Ethereum through deBridge, and deposited roughly 455.9 ETH into Tornado Cash between 19:20 and 19:49 UTC. The trail stops at the mixer. No user was phished and no private keys were compromised during any of this, because the victims never signed the transactions that emptied their accounts.

Blockaid’s Response: Real-Time Detection and Ecosystem Alerting

Blockaid identified the attack while it was still in progress. The attacker's primary wallet was already flagged as malicious across Blockaid's customer network, along with the two Ethereum addresses that had funded the operation, 0xa1a15f1b0d4878873f2933573e4385ab1e4df25c and 0x775028b2ce02844e8947905e4d655940a76cf559. Every wallet provider and exchange on that network receives those verdicts in real time. Blockaid's Onchain Monitoring tracked the drain as it happened, transaction by transaction, through automated detection that flagged the exploit behavior as it executed. That visibility is what lets teams leveraging Onchain Monitoring catch an attack in its first transactions and respond before it cascades across an ecosystem and its users.

As the attacker moved the funds, Blockaid traced the full path through automated fund-flow tracking, from the swaps into SOL on Solana, through the deBridge transfer to Ethereum, to the final deposits into the Tornado Cash router 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b, totaling roughly 455.9 ETH. Blockaid confirmed that none of its customers were directly exposed, published an ecosystem alert so that customers across its network had the attacker addresses and context, and continued monitoring for further movement.

Once the proceeds reached Tornado Cash, the onchain trail ended. Rain has since confirmed that the root cause was an outdated Solana card contract, and that the contract has been upgraded across all of its programs, with no further unauthorized activity observed.

Why Onchain Monitoring Matters for Stablecoin Card Issuers

The bug lived in one contract, but the exposure lived across many programs. Card programs built on shared infrastructure often run the same underlying contract, so a single flaw is not contained to the program where it is first exploited. It sits latent in every deployment of the same code. For a stablecoin card issuer, that makes contract risk a fleet problem, and three lessons follow from this incident:

• Even robust contracts carry residual risk: Contract developers do their best to ship code without vulnerabilities, and flaws still reach production. Onchain Monitoring closes that gap by detecting exploit behavior as it executes and flagging it for action, whatever the underlying bug.
• Issuers need real-time visibility across their entire contract ecosystem: An infrastructure provider whose contract powers a fleet of downstream programs needs to know, at any moment, which deployments run which version and where risk concentrates. Onchain Monitoring maintains that map continuously, across every program built on the contract.
• One detection covers the whole fleet: The attacker drained at least two of the four deployments running the vulnerable contract. Fleet-level visibility removes that luck, because the moment one deployment shows exploit behavior, every other program running the same code is identified before the attacker reaches it.

Applied to an incident like this one, that coverage changes the timeline. The moment the first unauthorized AddCollateralAdmin and WithdrawCollateralAsset sequence appears, continuous monitoring can surface it as malicious behavior within the first transactions, long before thousands of accounts are drained. A signing-layer or wallet permission check cannot see this attack, because the user never signs. The control point is the contract layer and the behavior on it, which is precisely what continuous onchain monitoring watches.

Learn more about Onchain Monitoring →

Shared Infrastructure, Shared Blast Radius for Crypto Neobanks

Avici was the most heavily affected of the named programs, with $500,859 drained from 1,685 users, and it was not the only one. Tria, another program running on the same Rain contract, lost roughly $431,945 across 636 users in the same attack, and Solayer Pay was reported to be affected as well. All of it traced back to one exploit of one shared contract, reaching every brand that had deployed it. Across the affected programs, the attacker cashed out roughly $1.1 million into Tornado Cash.

This is the structural risk of building on shared card infrastructure, and it is also what makes the model powerful, since a program can launch quickly on proven rails without rebuilding settlement and card issuance from scratch. The same leverage that lets one contract serve many brands lets one flaw in that contract threaten all of them at once, and the risk flows downstream. The vulnerable contract sat at the infrastructure layer, but the drained balances belonged to the users of the crypto neobanks built on it, and the fallout landed on those brands. Avici refunded every affected user in full and added 10% cashback, and its token fell 49% from its daily high before partially recovering. For a crypto neobank, the security of the vendor's contract is the security of its own users' funds, and it cannot watch that code change without dedicated monitoring.

Conclusion

This incident is a lesson in card-balance infrastructure risk. The failure sat in a contract that held real user funds and accepted a malformed authorization, compounded by the fact that the same contract stood behind many programs at once. Users' own keys and wallets were never the weak point, and no phishing or stolen seed phrase was involved.

Blockaid detected the attack as it happened, having already flagged the attacker's wallet and its funding addresses as malicious, traced the stolen funds across chains to the point they entered a mixer, and alerted its customer network. The funds were gone before they could be recovered, which is the nature of an exploit that reaches a mixer within minutes of the drain.

The broader lesson points forward. Stablecoin cards are moving real volume onto shared onchain infrastructure, and the contracts underneath them now hold meaningful balances for growing numbers of users. Treating those contracts as a fleet, with continuous visibility into every deployment and the behavior on each, is how an issuer catches the next version of this attack in its first transactions instead of reading about it afterward. For the companies building the future of stablecoin payments, that visibility is becoming part of the cost of doing business responsibly.

Request a demo →

About Blockaid

Blockaid is the onchain security platform trusted by the largest companies operating in Web3. Built by veterans of elite intelligence and cybersecurity units, Blockaid provides end-to-end protection for financial institutions, protocols, and end users, combining direct wallet and dApp integrations with real-time monitoring, detection, and response across smart contracts, infrastructure, and externally owned accounts. Since 2025, Blockaid scanned over 6.3 billion transactions and blocked 585 million attacks. Blockaid is the security infrastructure behind Coinbase, MetaMask, Uniswap, Safe, and dozens of the most widely used platforms in the industry.

Learn more at blockaid.io, and follow us on Twitter and LinkedIn.