DeFi

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet, which had been funded just three hours earlier with 1.79 SOL—purchased with roughly $190 in USDC bridged from Ethereum—initiated a systematic drainage of card-balance accounts associated with Avici, a prominent Solana-based neobank. This breach, which persisted for over two hours, exposed the inherent risks hidden within the rapidly expanding "non-custodial" crypto card sector. By the time the incident was contained, 1,685 users had seen their balances liquidated, resulting in a total loss of $500,859.22.

The event serves as a stark case study in the gap between legal marketing and technical reality. Avici’s terms of service, last updated in June 2025, explicitly stated that neither the platform nor its issuer held custody of collateral. While legally accurate, the statement masked a technical vulnerability: the funds resided in a contract that, while nominally belonging to the user, remained under the administrative control of the program manager—a party capable of upgrading the contract with a single, plain signing key.

A Chronology of the Breach

The exploit was precise. The attacker’s wallet, identified by the address starting in "FVNFz," remained idle for 189 minutes after its initial funding before launching the attack. Between 16:49:48 and 19:18:52 UTC, the attacker executed approximately 21,405 transactions against a Solana-based program managed by Rain, the infrastructure provider powering the card.

The mechanics of the exploit exploited a flaw in signature verification. Each successful transaction involved a call to the native Ed25519 verification instruction. The attacker pointed the signature, key, and message offsets back at the initial instruction, allowing one signature to satisfy a check that required two. This granted the attacker administrative rights over individual user accounts, enabling the withdrawal of assets.

Rain, the card-issuing company behind Avici and several other programs, intervened by patching the affected contracts. The first patch was pushed at 19:18:37 UTC, just fifteen seconds before the final exploit transaction occurred. While the damage was significant, the immediate financial impact was mitigated by a prompt, company-led refund initiative. Avici and Tria—a second program hit by the same vulnerability—confirmed that all impacted users were made whole, with the companies absorbing the losses and providing an additional 10% premium to affected customers.

The Ecosystem: $1.1 Billion in Monthly Volume

The incident occurred against a backdrop of explosive growth for the crypto card industry. According to data from Paymentscan, the total monthly volume for crypto-linked cards reached $1.116 billion in August 2026, spanning 11 million transactions and nearly 288,000 active addresses. This marks the second consecutive month exceeding the $1 billion threshold.

However, these figures require nuance. The Paymentscan series has been restated to include previously unattributed issuer flows and to shift from on-chain top-up tracking to self-reported spend figures for platforms like RedotPay, which alone accounts for approximately 36% of the headline volume. When filtering for purely on-chain observable spend, the volume is closer to $545 million, reflecting a 55% increase since March 2026.

Concentration remains a critical structural factor. Nearly 42% of the total monthly volume is settled through Rain-affiliated programs. When combined with other major providers, a small cohort of companies facilitates over three-quarters of the entire tracked market. This concentration suggests that while the industry is scaling, it is also becoming increasingly reliant on a handful of underlying infrastructure providers.

The Five Custody Models

To understand the risk, one must categorize how these cards manage assets. Research into 18 leading programs reveals five distinct custody models, ranked from the weakest to the strongest user protection:

1. Sold to the Operator: In this model, as seen with KAST, assets transferred to the platform are legally considered sold to the company. The user essentially holds an unsecured debt claim against the operator.
2. Held in Custody for the User: Platforms like RedotPay and Revolut act as custodians. While legal title often remains with the user, these assets are typically subject to general liens and creditor claims in the event of insolvency.
3. Fiat Conversion at a Licensed Issuer: Programs like Crypto.com and Kraken convert crypto to fiat immediately upon sale. In the EU, these funds are subject to "safeguarding" regulations, which provide statutory protection against insolvency.
4. Program-Pool Smart Contracts: This model, utilized by Avici and Rain, places user funds in smart contracts. While "non-custodial" in spirit, the program manager often retains upgrade authority, as demonstrated by the August 28 exploit.
5. Self-Custodial Vaults: The strongest tier, exemplified by Gnosis Pay and Ether.fi, uses smart account modules that prevent the operator from accessing user funds, typically relying on time-locked modules or user-controlled multisig keys.

The "Third National" Connection

A significant portion of the self-custodial card market relies on an entity known as "Third National." While marketing materials often frame this as a bank, the entity is a Puerto Rico-based money transmitter and an affiliate of Signify Holdings (Rain).

The reliance on a non-bank issuer for credit-card-style settlement highlights the complexity of the "stablecoin-powered" payment model. When a user taps their card, Visa settles with the merchant, and Rain settles with Visa using borrowed stablecoin liquidity, later clawing back the funds from the user’s smart contract. This creates a reliance on institutional liquidity that, while efficient, introduces systemic risk if the underlying program manager faces operational or regulatory hurdles.

Regulatory and Structural Implications

The regulatory environment is shifting rapidly. With the European Union’s Anti-Money Laundering Regulation (Regulation 2024/1624) set to take effect in July 2027, the "no-KYC" (Know Your Customer) model faces a potential existential threat. The new rules effectively bar anonymous crypto-asset accounts and prohibit EU acquirers from processing transactions from anonymous prepaid cards issued in third-party jurisdictions.

The failure of the Gnosis Pay consumer interface in September 2026, alongside the winding down of other infrastructure providers like Kulipa and the loss of Paytend’s license, underscores the fragility of these programs. In many instances, the shutdown of a service is not decided by the consumer-facing brand, but by the underlying bank or payment network.

Lessons from the August Breach

The August 28 incident was not a failure of "self-custody" as a concept, but a failure of operational transparency. The users who lost funds held their own keys, but they relinquished control to a smart contract architecture where the upgrade authority was held by a single, centralized key—a detail that was not explicitly disclosed in user-facing documentation.

The fact that users were reimbursed is a testament to the venture-backed capital reserves of the platforms involved. However, relying on the benevolence of a private company to cover losses is a far cry from the technical, trustless guarantees promised by decentralized finance. As the sector matures, the focus must shift from marketing "non-custodial" status to providing verifiable audits of contract upgrade authorities, clear legal definitions of asset ownership during insolvency, and transparent reporting on the identity and regulatory standing of the card issuer.

The industry is clearly at an inflection point. As volume crosses the billion-dollar mark, the "black box" nature of card infrastructure—where users cannot see who holds the upgrade keys or how the settlement is financed—represents the most significant tail risk for the average consumer. For the 11 million transactions occurring monthly, the question remains: is the user a participant in a decentralized network, or simply a creditor to a new type of digital bank? The answer, as of late 2026, is that for most, it is the latter.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of transactions that would trigger a crisis for Avici, a prominent Solana-based neobank. By the time the dust settled, 1,685 users had been drained of $500,859.22. This incident was not a breach of individual private keys or a compromise of user wallets; rather, it was a structural failure within a shared smart contract infrastructure managed by Rain, the firm that serves as the card-issuing backbone for a significant portion of the self-custodial crypto card market.

The breach highlights the growing, often invisible complexity of the $1.1 billion-a-month crypto card industry. While marketing materials frequently tout these products as "non-custodial," the technical reality is far more nuanced. In the case of Avici, the funds were held in smart contracts that, while technically accessible to users, were subject to administrative authority that could be—and was—exploited.

A Chronology of the August Drain

The exploit was surgical and efficient. The attacker’s wallet, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching the attack. Between 16:49:48 UTC and 19:18:52 UTC, the wallet executed approximately 21,405 transactions against a Rain-controlled Solana program. Roughly 17,500 of these were successful.

Each successful transaction utilized a specific authorization loophole. The attacker performed a SubmitSignatures call paired with a native Ed25519 signature-verification instruction. By manipulating the signature, key, and message offsets, the attacker bypassed the program’s two-signature requirement, effectively tricking the smart contract into granting them "collateral admin" status. Once this status was achieved, the attacker systematically withdrew assets from over a thousand individual user accounts.

The impact was swift. By 19:03:18 UTC, while the drain was still in progress, the attacker utilized a deBridge order to move over $1 million in USDC to Ethereum. This was followed by a series of smaller swaps through Jupiter to convert the remaining 886.94 SOL. The total haul, approximately 1,113,096.76 USDC, was funneled into a single Ethereum address. Within less than thirty minutes of the final bridge, the funds were processed through the Tornado Cash mixer in a standard laddered sequence.

The Institutional Response

The resolution of the incident was as rapid as the theft. Because the affected programs—Avici, Tria, and Solayer—relied on Rain’s infrastructure, the response was coordinated at the issuer level. By 19:18:37 UTC, Rain had begun patching the most severely affected program. The remaining two were patched within thirty minutes.

Avici confirmed that all 1,685 affected users were fully reimbursed, with the capital provided by Rain and an additional 10% buffer added by the programs themselves. This rapid "make-whole" approach served to stabilize the ecosystem, but it also underscored a critical reality: the "non-custodial" nature of these cards is a spectrum. While the users held their keys, the underlying collateral was stored in a contract governed by an upgradeable key held by a private entity. When that entity—Rain—suffered a failure, the company’s own balance sheet became the insurance policy.

Data and Market Concentration

Paymentscan data for August 2026 illustrates the sheer scale of this sector. Total volume reached $1.116 billion across 11 million transactions, marking the second consecutive month above the billion-dollar threshold. However, this headline number requires careful interpretation. Approximately 42% of this volume, or $468 million, is tied to programs settling through Rain. When including RedotPay—which self-reports spend metrics—two entities effectively control nearly 78% of the tracked market.

This concentration of infrastructure creates systemic risk. The August incident proved that when a single issuer’s codebase is vulnerable, the failure propagates across multiple, seemingly distinct brands simultaneously. While Ether.fi Cash remained untouched, its isolation was not due to luck but to its specific architectural design, which utilizes individual, isolated vaults rather than a shared collateral pool managed by an overarching program administrator.

Custody Models: Five Tiers of Risk

To understand the risks, one must categorize how these programs hold value. The industry generally falls into five tiers:

1. Sold to the Operator: In this model, as seen with KAST, users essentially trade their crypto for a debt claim. Once the assets are transferred, the user no longer holds an ownership interest in the crypto but rather an enforceable claim against the operator’s corporate treasury.
2. Custodial Nominee: Platforms like Revolut and RedotPay hold assets on behalf of the user. While the user is the beneficial owner, the legal title rests with the platform, making the assets subject to the platform’s insolvency risk.
3. Fiat Conversion: Cards from major exchanges like Crypto.com or Kraken often do not hold crypto at all. Instead, the crypto is converted to fiat at the moment of sale, and the resulting fiat is held by a regulated e-money institution.
4. Program-Managed Collateral: This is the model used by Avici and Tria. Funds reside in smart contracts that are "non-custodial" in that they are not held in a central omnibus account, but they are subject to an administrator’s logic, which can be altered or exploited.
5. Vault-Based Self-Custody: Programs like Gnosis Pay and Ether.fi Cash represent the highest tier of security. Funds are held in individual smart contracts (Safes or Vaults) that are controlled by the user, with spend permissions strictly limited and automated by code rather than administrative decree.

The "No-KYC" Illusion

Parallel to the main market, a "no-KYC" card segment has proliferated, often operating in a regulatory gray area. These cards, frequently marketed as privacy-centric, often mask significant counterparty risks. An analysis of eleven such cards revealed that only one named its issuer. The majority rely on "licensed partners" or opaque corporate entities.

The mechanism, as reported by industry observers, typically involves a company completing "Know Your Business" (KYB) verification to act as a master account, which then issues cards to individuals. This approach is highly vulnerable to regulatory crackdowns. When the sponsor bank or network—such as Visa or the institution behind the BIN—decides to terminate the program, the brands themselves are often powerless to assist their users, as seen in the 2026 collapse of Bit.Store following the revocation of its issuer’s license.

Implications and Regulatory Horizon

The European Union’s Anti-Money Laundering Regulation (EU 2024/1624), set to take effect in July 2027, poses a significant threat to the anonymous prepaid card segment. By prohibiting the use of anonymous crypto-asset accounts and restricting the ability of EU acquirers to accept payments from anonymous cards issued in third countries, the regulation will likely force a consolidation of the market.

For the mainstream, self-custodial sector, the August 2026 incident serves as a stark reminder of the "upgrade authority" risk. In the world of smart contracts, the code is only as secure as the key that governs its updates. Even when a platform correctly implements decentralized custody, if the contract can be upgraded by a single private keypair, the platform remains effectively custodial.

The shift toward multisig governance—as evidenced by Rain’s move to a Squads multisig vault following the breach—is a necessary evolution. However, it does not mitigate the fundamental reliance on the issuer’s technical competency. As the industry matures, cardholders are increasingly forced to look past the marketing of "non-custodial" assets and interrogate the underlying infrastructure: who writes the code, who holds the upgrade keys, and what happens if the issuer’s corporate entity faces insolvency?

As of September 2026, the sector continues to grow, fueled by $250 million in venture capital and increasing institutional integration with traditional networks like Visa. Yet, the events of August confirm that in the crypto card space, the gap between a "non-custodial" promise and a "non-custodial" reality is often defined by a single line of smart contract code. Users who rely on these products are advised to treat their card balances not as long-term savings, but as transient funds for daily commerce, acknowledging that the ultimate safeguard remains the willingness of the issuer to step in when the code fails.

With $1.1 billion in monthly volume, the crypto card industry is no longer a niche experiment. It is a vital, if fragile, bridge between decentralized finance and global retail payments. Whether that bridge remains stable depends on the industry’s ability to transition from "trust-me" models toward transparent, audit-ready, and truly immutable infrastructure. Until then, the risks associated with program managers, shared contract pools, and opaque issuing partners will remain a defining characteristic of the landscape.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of precise, automated transactions that began siphoning funds from the card-balance accounts of Avici, a Solana-based neobank. By the time the incident concluded, 1,685 users had seen $500,859.22 vanish from their accounts. This event, while contained within a specific segment of the crypto-card market, exposed the underlying fragility of the "non-custodial" card model, a rapidly growing sector that has seen monthly transaction volumes surge to over $1.1 billion as of August 2026.

The breach was not a result of compromised private keys or stolen user wallets. Instead, it exploited a structural vulnerability within the smart contract architecture used by Rain, the card-issuing company that powers the back-end infrastructure for Avici and several other prominent self-custodial card programs. While Avici’s terms of service, last updated in June 2025, assured users that neither the company nor the issuer held custody of their collateral, the incident demonstrated that "non-custodial" is a term defined more by legal intent than technical impossibility.

The Anatomy of the August 28 Drain

The exploit followed a calculated timeline. The attacker’s address, 0xFVNFzq…, sat idle for 189 minutes after its initial funding before executing the first of 21,405 transactions. Of these, approximately 17,500 succeeded. The attack targeted a specific flaw in the Ed25519 signature-verification instruction within the Rain-controlled Solana program. By manipulating signature, key, and message offsets, the attacker bypassed a two-signature verification requirement, effectively granting themselves administrative rights over individual user collateral accounts.

Once the attacker achieved administrative status, they systematically initiated withdrawals. The median loss per user was roughly $24, though the largest individual losses exceeded $5,000. It is a critical distinction that the funds were not stolen from a centralized pot; rather, the "non-custodial" architecture relied on a single administrative authority—a plain signing key—which the attacker successfully spoofed.

Rain, the infrastructure provider, responded with significant speed, issuing a patch for the most severely affected program at 19:18:37 UTC, just seconds before the attacker ceased activity. While the company initially faced criticism for relying on outdated contract versions, it eventually moved the upgrade authority for its programs to a Squads multisig vault on September 5, 2026, adding a layer of security that was absent during the August breach.

The State of the Crypto-Card Market: A $1.1 Billion Ecosystem

According to data from Paymentscan, the crypto-card industry reached a new milestone in August 2026, processing $1.116 billion in volume across 11 million transactions. This growth represents a 32% increase since March 2026, even after accounting for restated figures that include previously untracked issuer flows.

However, the headline numbers obscure significant diversity in how these programs function. The market is effectively split into five distinct custody models, ranging from direct sales of assets to the operator (effectively creating an unsecured debt claim) to true self-custodial vaults where the operator lacks the power to move user funds.

The most controversial model, exemplified by KAST, involves the "sale" of virtual assets to the operator upon deposit. In this arrangement, the user’s balance is a ledger entry representing an enforceable debt claim against the company. Following a public feud with the CEO of Ether.fi, KAST amended its terms in July 2026 to clarify that deposited assets are owned by the company treasury, and users are essentially unsecured creditors in the event of insolvency. This model has drawn sharp criticism from industry peers who argue that such structures bypass the protective regulations governing traditional financial institutions.

Issuer Concentration and Infrastructure Risk

A significant portion of the self-custodial card market—including Avici, Tria, Payy, Solayer, Plasma One, and Ether.fi Cash—relies on a single issuer: Third National. Public filings and legal disclosures reveal that Third National is not a bank, but rather a Puerto Rico-licensed money transmitter operating under the Signify Holdings, Inc. umbrella.

This concentration of power is a double-edged sword. While it allows for rapid innovation and seamless integration with the Visa network, it creates a systemic "single point of failure." When a vulnerability is found in the underlying contract template, as happened in August, the contagion spreads instantly across multiple brands.

Despite the August incident, consumer confidence remains surprisingly resilient. The total value of stolen funds was fully refunded by the affected companies within 24 hours. Avici stated that the refunds were facilitated by Rain, signaling that the venture-backed infrastructure providers are prioritizing reputation and user retention over the strict legal liability definitions found in their terms of service.

The Regulatory Horizon: The End of Anonymous Spending?

As the industry matures, regulators are moving to close the loopholes that allowed for the proliferation of "no-KYC" (Know Your Customer) cards. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, set to apply from July 2027, will effectively prohibit anonymous crypto-asset accounts. This regulation will specifically target the practice of loading cards from anonymous crypto sources, likely forcing a massive consolidation in the market.

Many of the smaller, niche cards identified in recent directories are already facing existential threats. Services like Bit.Store have already seen their operations shuttered following regulatory actions against their underlying electronic money institutions (EMIs), such as the revocation of Paytend Europe UAB’s license in early 2026. These shutdowns serve as a stark reminder that when a regulatory body intervenes, the brand the consumer interacts with often has no power to recover or return assets.

Analyzing the "Non-Custodial" Promise

The core lesson of the August 2026 exploit is not that self-custody is fundamentally flawed, but that the industry’s marketing language is often divorced from technical reality. In the context of a cardholder agreement, "non-custodial" often refers only to the status of the funds during normal operation. It rarely accounts for who holds the upgrade keys, whether the code currently running is the same as the code that was audited, or what happens when a program manager—like Rain—must act as a lender of last resort to keep a project solvent.

The resilience of the market is evidenced by the rapid adoption of new, more transparent models. Programs like Gnosis Pay, which utilizes a modular architecture with specific roles and delays, or Ether.fi Cash, which publishes its contract addresses and relies on advanced multisig security, represent the next generation of crypto-native finance. These programs aim to minimize the need for "corporate backstops" by moving the responsibility for security back to the user and the code itself.

As the industry enters the final quarter of 2026, the focus is shifting from pure volume growth to structural integrity. The $1.1 billion in monthly volume is a testament to the utility of stablecoin-powered payments, but the August 28 incident proves that the infrastructure supporting these transactions remains an evolving target. For the end user, the path forward requires a closer look at the fine print: understanding whether their funds are held in a vault they control, or if they are simply a secondary claimant in a complex, privately managed settlement network.

Ultimately, the crypto-card market has proven that it can weather technical breaches through sheer financial force. However, as regulatory pressure mounts and the market continues to consolidate around a handful of large infrastructure providers, the definition of "non-custodial" will likely undergo a necessary, more rigorous evolution. The era of blind trust in "smart contract" marketing is coming to an end, replaced by a demand for verifiable, immutable, and truly decentralized control.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based digital wallet initiated a sequence of transactions that would expose a critical vulnerability in the architecture of modern "non-custodial" crypto debit cards. The wallet, which had been funded just three hours earlier with 1.79 SOL—purchased via approximately $190 in USDC bridged from the Ethereum network—began systematically draining card-balance accounts held by users of Avici, a Solana-focused neobank. By the time the incident was contained, 1,685 users had seen a combined total of $500,859.22 siphoned from their accounts. The breach did not target the users’ personal keys or primary wallets; instead, it exploited the specific smart contract infrastructure that allows these cards to function as "non-custodial" financial instruments.

The incident highlights a growing tension in the decentralized finance (DeFi) sector between the promise of user sovereignty and the technical realities of card-issuing infrastructure. While Avici’s terms of service, last updated on June 23, 2025, explicitly stated that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," the reality of the smart contract deployment told a different story. The contract in question belonged to Rain, a card-issuing entity that provides the backbone for a significant portion of the self-custodial card market. Despite the breach, Avici confirmed that Rain covered every refund in full, with Avici and Tria—a secondary program also affected by the same vulnerability—adding a 10% surplus to compensate users for the disruption.

Chronology of the August 28 Exploit

The exploit was characterized by a high degree of technical precision. The attacker’s wallet, identified by the address FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching the attack. Between 16:49:48 UTC and 19:18:52 UTC, the wallet executed over 21,400 transactions. Each successful hit followed a three-step process: a SubmitSignatures call utilizing native Ed25519 signature-verification, followed by an AddCollateralAdmin instruction, and finally a WithdrawCollateralAsset command.

The core of the vulnerability lay in the program’s signature-verification logic. The attacker’s second verification instruction redirected its signature, key, and message offsets back to the first, effectively allowing a single signature to satisfy a check intended to require two. This granted the attacker administrative privileges over more than 1,000 individual user accounts. Because the funds were held in a smart contract that the program manager—in this case, Rain—could theoretically upgrade with a single plain signing key, the "non-custodial" nature of the assets was undermined by centralized administrative authority.

Rain’s remediation was swift but highlighted the risks of legacy code. The first patch for the most heavily impacted program was implemented at 19:18:37 UTC, just 15 seconds before the attacker ceased activity. Subsequent patches for the other two programs were deployed shortly thereafter. By September 5, 2026, Rain had migrated the upgrade authority for these programs to a Squads multisig vault, a more secure arrangement that prevents any single key from unilaterally modifying the contract.

Market Context and Volume Growth

The incident occurred against a backdrop of rapid expansion for crypto-linked payment cards. According to data from Paymentscan, monthly crypto card volume reached $1.116 billion in August 2026, spanning 11 million transactions and over 287,000 active addresses. This figure represents the second consecutive month of volume exceeding the $1 billion threshold. Since March 2023, the cumulative volume for this sector has reached $11.61 billion.

However, the headline figures require careful interpretation. Paymentscan recently restated its historical data to include ten additional programs and unattributed issuer flows. Notably, approximately 36% of the August volume is derived from self-reported data by RedotPay, which complicates independent verification. When excluding these self-reported figures, the total volume of on-chain observed spending stands at approximately $545 million, a 55% increase since March 2026. Ether.fi Cash currently stands as the largest program with fully transparent, on-chain visible purchases, accounting for $109.5 million in August volume.

Custody Models: A Spectrum of Risk

The diversity of custody models currently employed by the 18 programs reviewed reveals a wide spectrum of legal and technical risk. These models generally fall into five distinct categories:

1. Sale to the Operator: Some programs, such as KAST, utilize terms that frame the transfer of assets as a "sale" to the company. In this model, the user holds a USD-denominated debt claim against the issuer rather than an ownership interest in the original crypto assets.
2. Custodial Nominee: Programs like RedotPay and Revolut act as custodians, holding assets on behalf of the user. While this is a standard financial arrangement, it introduces dependency on the custodian’s solvency.
3. Fiat Conversion: Exchange-based cards, such as those from Crypto.com and Kraken, convert crypto to fiat at the moment of the transaction. In these cases, no crypto balances are held on the card, and users are protected by established electronic money (e-money) regulations in jurisdictions like the EU and UK.
4. Program-Pool Smart Contracts: Programs like Avici, Tria, and Payy utilize smart contracts where collateral is held in the card program’s pool. As demonstrated in the August 28 incident, the vulnerability of this model is linked to the administrative authority over the contract, not the user’s individual wallet keys.
5. Self-Custodial Vaults: The strongest model, utilized by Gnosis Pay and Ether.fi Cash, involves smart contracts or vaults that the operator cannot move. These programs typically use scoped spend permissions or "delay modules" to ensure the user retains control, though even these systems are subject to potential signature-verification flaws.

The Role of "Third National" and Infrastructure Concentration

A critical finding in the investigation of these programs is the concentration of issuing services. Seven of the 18 programs reviewed—including KAST, Avici, Ether.fi, and Solayer—name "Third National" as their card issuer. Legal disclosures reveal that Third National is a business name for Nimbus LLC, an affiliate within the Signify Holdings (Rain) group.

This structure means that a substantial share of the "non-custodial" card market relies on a Puerto Rico-based money transmitter rather than a traditional chartered bank. Rain’s operational model involves borrowing stablecoins to facilitate network settlement for credit card receivables, effectively turning these "non-custodial" cards into charge cards financed by the issuer. While this model has allowed for rapid scaling—evidenced by Rain’s recent $250 million Series C funding round—it creates a single point of failure for the programs that rely on its codebase.

Implications for the Future of Crypto Payments

The events of August 2026 serve as a stark reminder that in the world of crypto-native finance, marketing terminology often diverges from technical reality. The term "non-custodial" in a cardholder agreement describes who cannot move funds during normal operation, but it remains silent on the critical issues of who wrote the smart contract, whether the deployed code matches the audited version, and who holds the administrative upgrade keys.

The rapid recovery of funds for affected users was made possible not by the robustness of the underlying code, but by the financial reserves of a private venture-backed entity. This provides a temporary safety net, but it does not resolve the systemic risks inherent in centralized administration of "decentralized" products. As the EU prepares to implement the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) in 2027, the regulatory landscape for anonymous or "no-KYC" cards is expected to tighten significantly. These regulations will likely prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions.

For the end user, the path forward requires a higher degree of due diligence. Beyond the marketing slogans, participants must evaluate the specific custody model, the legal identity of the card issuer, the provisions regarding insolvency, and the security of the smart contract upgrade path. The August incident was a loud failure that necessitated a high-profile response, but as the broader industry matures, the quiet failures—such as the wind-downs of Kulipa and Gnosis Pay’s consumer interface—suggest that the market is beginning to prioritize sustainable, transparent infrastructure over rapid, experimental growth. The $1.1 billion monthly volume confirms the utility of crypto-linked cards, but the technical vulnerabilities exposed this summer emphasize that the bridge between traditional finance and blockchain remains under construction.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in bridged USDC—began a systematic extraction of funds from card-balance accounts managed by Avici, a prominent Solana-based neobank. This event, which lasted roughly two and a half hours, served as a stark reminder of the underlying vulnerabilities within the rapidly expanding "non-custodial" crypto debit card sector. By the time the final transaction occurred at 19:18:52 UTC, 1,685 users had seen a combined $500,859.22 vanish from a smart contract infrastructure shared by several programs, including Avici and Tria.

The incident was not a result of compromised user keys or illicit wallet access. Rather, the vulnerability resided in the very architecture that proponents often cite as the hallmark of safety: a specialized smart contract designed for card collateral. These contracts, while ostensibly user-controlled, are frequently subject to administrative upgrade paths that rely on single signing keys. This centralized control, combined with a signature-verification flaw, allowed the attacker to grant themselves administrative privileges over individual user accounts, effectively bypassing the security models that users believed were protecting their assets.

The Chronology of the August 28 Exploit

The precision of the attack suggests a sophisticated understanding of the target’s technical debt. The attacker’s wallet, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, performed 21,405 transactions during the exploit window, with 17,500 succeeding. Each success followed a three-step sequence against a Rain-controlled Solana program: an initial SubmitSignatures call utilizing a native Ed25519 signature-verification instruction, followed by an AddCollateralAdmin call, and concluding with a WithdrawCollateralAsset command.

The critical failure involved a faulty verification instruction that directed signature and message offsets back at the initial call, allowing a single signature to satisfy a two-signature requirement. This oversight effectively turned the attacker into a "collateral admin" for thousands of accounts. By 19:03:18 UTC, while the exploit was ongoing, the attacker initiated a deBridge order to move over 1 million USDC from Solana to Ethereum, which was subsequently funneled through Tornado Cash in standard mixing increments.

Rain, the card-issuing infrastructure provider behind these programs, responded by patching the affected Solana programs between 19:18 UTC and 19:43 UTC. On September 5, 2026, Rain transitioned the upgrade authority for these programs to a Squads multisig vault, a critical security improvement that was not publicly announced but was verified via on-chain analysis on September 10.

The Scale of the Crypto Card Market

Data from Paymentscan indicates that the crypto card market has entered a period of hyper-growth, with August 2026 volume reaching $1.116 billion across 11 million transactions. This represents a significant shift from the $153 million recorded in December 2024. While these figures reflect a maturing industry, they also mask significant complexities regarding how funds are actually held.

Paymentscan identifies five distinct custody models, ranging from "Sold to the Operator"—where the user holds only a debt claim against the issuer—to "Your Own Vault," where funds remain in a self-custodial smart contract debited only at the moment of authorization. The industry remains highly concentrated; Rain alone facilitates settlement for roughly 42% of the market’s total volume. When combined with RedotPay’s self-reported figures, just two entities account for approximately 78% of the total tracked volume. This concentration creates a systemic risk profile where a single technical failure in a shared codebase can affect dozens of seemingly disparate brands simultaneously.

The Myth of Non-Custodial Security

The term "non-custodial" has become a marketing imperative in the crypto card space, yet its legal and technical definitions vary wildly. Avici’s terms of service, last updated in June 2025, assured users that the company would never hold custody of collateral. While legally accurate, this statement provided little comfort to the 1,685 users whose funds were drained due to a flaw in the underlying Rain-managed contract.

This gap between marketing and mechanism is exemplified by programs like Solayer, which markets its Emerald card as "fully on-chain" while its internal security documentation reveals the use of offline, multisig-protected cold storage. This is, by definition, a custodial arrangement. The industry’s reliance on "Third National"—a Puerto Rican money transmitter and Rain affiliate—as an issuer for seven major programs further highlights the distance between the "DeFi" ethos and the reality of traditional financial infrastructure. These cards are effectively charge cards financed by borrowed stablecoins, not the seamless, on-chain experiences often depicted in promotional materials.

Regulatory and Institutional Implications

The regulatory landscape is set to undergo a fundamental shift with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) in July 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions. For the "no-KYC" card sector, this presents an existential threat. Currently, these services exploit the gap between "Know Your Business" (KYB) verification for the issuer and the lack of individual KYC for the cardholder.

Recent infrastructure failures—such as the collapse of the Kulipa program in July 2026, which abruptly ended services for Ready, Argent, and Solflare—demonstrate that the primary risk to users is often not a hack, but rather the fragility of the underlying business relationships. When issuers like Paytend have their licenses revoked or programs like Fiat24 pause operations to address compliance gaps, the brand the consumer interacts with is often left powerless to assist.

Official Responses and Remediation

The response to the August 28 exploit was swift, if opaque. Avici and Tria, recognizing the reputational damage at stake, opted to cover the losses out of their own balance sheets, with Avici explicitly stating that Rain funded the refunds. The total impact, approximately $1.1 million, was mitigated for the end-user within 24 hours. However, the incident highlighted a dangerous lack of transparency regarding pre-deployment audits. While Rain claims to use Sherlock for audits, the drained contracts were older versions that remained live—a classic "legacy code" vulnerability that audit-at-deployment models fail to address.

Ether.fi Cash remains a notable outlier in the category. By utilizing a public, address-verified vault on Optimism and maintaining clear documentation on its CashModule contract, it offers a level of transparency that is currently the exception, not the rule. The contrast between Ether.fi’s architecture and the shared, opaque collateral pools of other programs is a lesson in the importance of technical due diligence over marketing claims.

Moving Forward: What Users Should Analyze

For the end-user, the August 2026 events suggest five critical questions that must be addressed before depositing funds into any crypto-linked card:

1. Custody Classification: Does the contract transfer ownership to the operator, or is it a true self-custodial vault?
2. Issuer Identity: Is the issuer a chartered bank, an EMI, or an offshore money transmitter? If the issuer is not clearly named, the program should be viewed as high-risk.
3. Insolvency Protection: What happens if the service provider goes bankrupt? If the terms do not explicitly address the status of user funds in an insolvency event, users should assume they are unsecured creditors.
4. Upgrade Authority: Who holds the keys to upgrade the contract? If a single private key controls the contract, the "non-custodial" nature of the product is largely performative.
5. Transparency of Metrics: Are volume and spend metrics verifiable on-chain, or are they self-reported numbers that lack independent oversight?

The rapid expansion of the crypto card market in 2026 has provided users with unprecedented convenience, but it has also introduced a level of technical and systemic risk that the current marketing landscape fails to articulate. While the August 28 exploit ended with users being made whole, the next failure may not be supported by a $338 million venture-backed balance sheet. As the industry approaches the 2027 regulatory deadline, the divergence between robust, transparent platforms and those relying on "nuanced loopholes" will likely accelerate, forcing a consolidation that favors transparency and structural integrity over the current proliferation of proprietary, black-box solutions.

The reliance on a single company to manage nearly half of the market’s settlement volume creates a "too-big-to-fail" scenario that contradicts the decentralization tenets of the blockchain ecosystem. Ultimately, the stability of the crypto card market in the coming years will depend less on the cleverness of its smart contract marketing and more on the regulatory and technical rigor of the institutions standing behind the cards. Until that time, the user is left to navigate a landscape where "non-custodial" is a description of the current state of a contract, rather than a guarantee of future security.