Avici exploit attacker used $190 in bridged USDC to siphon about $670K, with 8,857 transactions since 16:49 UTC
Avici confirmed it was hit by an authorization-bypass exploit, with the attacker stealing about $670K. On-chain data show the attacker created a wallet at 13:40 UTC and bridged in $190 of USDC from Ethereum to cover gas. Draining began at 16:49 UTC and has continued, with 8,857 transactions executed by submitting a signature bundle, calling AddCollateralAdmin to gain admin privileges, and then withdrawing. The data indicate a verification flaw in which the second signature check pointed back to instruction 0, and the protocol’s upgrade key has not been used since March 2025.