Crypto Card Exploit Drains $1.1 Million, Sends Neobank Token Crashing 49%

A security flaw in an outdated card contract led to roughly $1.1 million being drained across several Solana based programs, with one crypto neobank losing more than $500,800 from over 1,600 affected users. The breach caused the platform’s native token to plunge nearly 49% within 24 hours.

The affected neobank, which lets users spend crypto through a Visa-linked card, saw its token fall from a daily high before hitting a record low, later recovering partially. A second crypto neobank also reported hundreds of users impacted, with losses exceeding $430,000, and pledged to fully reimburse those affected despite its own token dropping sharply.

Attack Traced to Solana Contract Handling Card Top-Ups

According to the affected companies, the exploit targeted a Solana based contract responsible for holding funds once users loaded money onto their cards, while self-custodial wallets on other networks remained secure. The infrastructure provider behind the card technology confirmed it identified the vulnerability in an older contract version, upgraded all affected programs, and reported no further suspicious activity since.

Stolen Funds Moved Through Multiple Chains

Blockchain data show the attacker repeatedly used a signed authorization to gain administrative access to individual card accounts before withdrawing funds. The stolen assets were converted into a different cryptocurrency, moved across blockchains, and ultimately routed through a privacy mixing service, making recovery difficult.

The affected neobank confirmed it has reported the incident to federal cybercrime authorities. Timelines and funding sources for user refunds have not yet been disclosed.