UPDATE:
@Avici says all affected card balances will be refunded in full after 1,685 users lost a combined $500,859.
Card issuer Rain identified a vulnerability in a Solana card contract used by Avici and several other programs. The contract has since been upgraded.