DeFi

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based wallet—funded just three hours prior with 1.79 SOL via a bridge from Ethereum—executed the first of over 21,000 transactions that would systematically drain thousands of user accounts belonging to Avici, a prominent Solana-focused neobank. By the time the incident concluded, 1,685 users had seen their balances liquidated, totaling $500,859.22 in losses. This breach was not a result of compromised private keys or standard phishing; rather, it exploited a critical vulnerability in a shared smart contract architecture used by Avici and several other programs within the burgeoning self-custodial crypto card market.

The incident highlights a growing tension in the financial technology sector: the gap between the marketing promise of "non-custodial" finance and the technical reality of how these assets are governed. While Avici’s terms of service explicitly stated that the company would not hold custody of user collateral, the underlying smart contract infrastructure—managed by the card-issuing company Rain—contained an authorization flaw that allowed an attacker to bypass security checks. This event has forced a broader audit of the $1.1 billion monthly crypto card industry, raising questions about transparency, issuer reliance, and the legal status of digital assets in the event of platform failure.

The Anatomy of the August 28 Breach

The attack vector was surgically precise. The perpetrator’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, targeted a vulnerability in the signature-verification instruction of a Rain-controlled Solana program. By manipulating signature and message offsets, the attacker effectively tricked the program into accepting a single signature as the required dual-authorization for administrative actions. Once the attacker granted themselves "Collateral Admin" status, they were able to initiate asset withdrawals from individual user accounts.

The chronology of the event reveals the speed at which modern on-chain exploits unfold. The initial exploit began at 16:49:48 UTC, and the final malicious transaction was recorded at 19:18:52 UTC. In the interim, the attacker managed to successfully process approximately 17,500 transactions. By 19:03:18 UTC, while the drain was still in progress, the attacker initiated a series of deBridge orders to move approximately 1.1 million USDC from the Solana network to Ethereum. These funds were subsequently funneled into Tornado Cash in a standard "laddered" withdrawal pattern, effectively obscuring the trail of the stolen capital.

Rain’s response was rapid but highlighted the centralized nature of what is often marketed as decentralized infrastructure. The company patched the affected Solana programs between 19:18 and 19:43 UTC, mere minutes after the drain concluded. Following the patch, Rain and the affected programs, including Avici and Tria, committed to full refunds. While this prevented a public relations catastrophe, it underscored a reality that the industry rarely discusses: the "non-custodial" cardholder was ultimately saved by the corporate balance sheet of a venture-backed firm, not by the inherent security of the blockchain itself.

The State of the Crypto Card Market: $1.1 Billion and Counting

According to data from Paymentscan, the crypto card industry has seen explosive growth. As of August 2026, monthly transaction volume hit $1.116 billion across 11 million individual transactions and nearly 290,000 active addresses. This marks the second consecutive month that the sector has exceeded the billion-dollar milestone, following a steady climb from $153 million in December 2024.

However, these figures carry significant caveats. A substantial portion of this volume—nearly 42%—is routed through Rain, which acts as the infrastructure provider for numerous smaller programs. Furthermore, the reliance on self-reported data from major players like RedotPay makes it difficult to ascertain the true level of risk within the ecosystem. When adjusting for on-chain verifiable spend, the actual figures are closer to $545 million, representing a 55% increase since March 2026. This discrepancy highlights the lack of standardized reporting in the crypto payments space, where market share is often conflated with user activity.

The Custody Spectrum: Five Models of Risk

To understand why some cards were vulnerable while others remained secure, one must look at the legal and technical "custody models" currently in operation. The industry generally falls into five distinct categories, ranging from total loss of ownership to true self-custody.

1. Sold to the Operator: In this model, such as that employed by KAST, the user’s deposit is legally considered a sale of assets. The user no longer owns the cryptocurrency but instead holds a debt claim against the platform. In the event of a bankruptcy, these users are merely unsecured creditors.
2. Held in Custody: Platforms like RedotPay and Revolut act as custodians. While they claim to hold assets for the user, these assets are often subject to general liens and may be reachable by the platform’s creditors during insolvency proceedings.
3. Fiat Conversion: Exchange-based cards, such as those from Crypto.com or Kraken, often do not hold crypto on the card at all. Assets are converted to fiat at the moment of the transaction, and the fiat is held in regulated bank accounts. While this offers the most protection, it is dependent on the regulatory status of the bank, not the security of the blockchain.
4. Program-Managed Smart Contracts: This was the model utilized by Avici and Tria. The collateral sits in a smart contract. While the user technically owns the assets, the "upgrade authority"—the power to change the rules of the contract—is often held by the program manager (in this case, Rain). The August breach occurred because this authority was centralized, not distributed.
5. Direct Authorization Vaults: Gnosis Pay and Ether.fi Cash represent the most secure tier. Here, the user retains control over a smart contract (a "Safe") where funds remain until an authorization is explicitly signed. Even if the program manager fails, the user’s assets remain in their own vault, inaccessible to the provider.

The "Third National" Concentration Risk

A significant systemic risk identified in the 2026 data is the concentration of issuers. Seven major programs—KAST, Avici, Ether.fi, Plasma One, Solayer, Payy, and Tria—all name "Third National" as their card issuer. Investigations reveal that Third National is not a bank in the traditional sense, but a Puerto Rico-based money transmitter and a subsidiary of Signify Holdings (Rain).

This creates a "single point of failure" scenario. When an infrastructure provider like Rain faces a technical exploit, the impact is not isolated to one brand but ripples across the entire portfolio of programs that rely on their shared codebase. The August incident demonstrated that while the brands appear distinct to the consumer, they are fundamentally tethered to the same administrative keys and contract logic.

Regulatory Horizons and Future Implications

The industry is currently facing a dual challenge: increasing regulatory scrutiny and the natural consolidation of infrastructure. With the European Union’s Anti-Money Laundering Regulation (EU 2024/1624) set to take full effect in July 2027, the era of anonymous, no-KYC crypto cards is nearing an end. The new rules effectively ban anonymous prepaid cards loaded with crypto, forcing providers to either implement rigorous identity verification or face exclusion from EU merchant terminals.

For the self-custodial sector, the lessons of August 2026 are clear. "Non-custodial" is a marketing term that fails to describe the reality of governance. The security of a card program is not merely about whether the user holds their private keys, but about who holds the upgrade keys to the smart contracts, whether those contracts have been audited for the specific version currently in production, and how the program is financed.

As the industry matures, the survivors will likely be those who can provide the highest degree of technical transparency. Ether.fi and Gnosis Pay have set a new standard by publishing contract addresses and governance modules, allowing users to verify for themselves where their money sits. In contrast, programs that hide behind opaque "licensed partners" and "proprietary infrastructure" remain inherently vulnerable.

Ultimately, the August exploit serves as a stark reminder that while the blockchain provides a ledger of truth, the surrounding financial infrastructure—the bridges, the issuers, and the administrative authorities—is only as robust as its weakest line of code. For the 1,685 users who were made whole, the experience was a fortunate reprieve. For the industry, it is a definitive call to move away from centralized "non-custodial" templates toward architectures that truly prioritize user sovereignty over administrative convenience.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began systematically draining card-balance accounts held by users of Avici, a prominent Solana-based neobank. By the time the exploit was neutralized, 1,685 users had seen their balances liquidated, totaling a loss of $500,859.22. This incident, while rapidly contained, has cast a harsh spotlight on the "non-custodial" crypto card market, a sector that has seen its monthly transaction volume explode to over $1.1 billion as of August 2026.

The vulnerability did not stem from stolen private keys or compromised user devices. Instead, it lay within a specific Solana card contract shared by Avici and several other programs. The underlying infrastructure belongs to Rain, a card-issuing company that has become the backbone of much of the self-custodial card market. While Avici’s terms of service, last updated in June 2025, assured users that neither the company nor the issuer held custody of their collateral, the technical reality of the smart contract architecture allowed for a systemic failure. The incident serves as a stark reminder that in the world of crypto-native finance, the definition of "non-custodial" is often dictated by the nuance of smart contract permissions rather than the absolute security of user assets.

A Chronology of the August Drain

The exploit was surgical and efficient. The attacker’s wallet, identified on-chain as 0xFVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching its first attack at 16:49:48 UTC. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 successfully interacting with the Rain-controlled Solana program.

The mechanics of the exploit relied on an authorization bug within the SubmitSignatures call. By manipulating the signature-verification instruction—pointing the signature, key, and message offsets back at one another—the attacker managed to satisfy a two-signature check with only a single signature. This granted the attacker administrative status over individual user collateral accounts, allowing for the immediate withdrawal of funds.

The fallout was swift. Between 19:03 and 19:49 UTC, as the drain was concluding, the stolen funds were bridged from Solana to Ethereum and moved through Tornado Cash. By 19:18 UTC, Rain had begun patching the affected programs. By September 5, all upgrade authorities for the involved contracts were successfully migrated to a Squads multisig vault, providing a long-term fix to the security architecture.

Market Growth and Concentration Risks

According to data from Paymentscan, the crypto card market has witnessed extraordinary growth, rising from $153 million in monthly volume in December 2024 to $1.116 billion by August 2026. This trajectory highlights a significant shift in consumer behavior, as users increasingly seek to bridge the gap between volatile digital assets and daily retail spending.

However, this growth is heavily concentrated. Paymentscan’s issuer mapping attributes approximately 42% of August’s total volume—$468 million—to programs settling through Rain. When combined with the self-reported figures from RedotPay, these two entities facilitate roughly 78% of the entire tracked crypto card market. This concentration presents a systemic risk: while the August exploit was limited to specific Solana contracts, the reliance on a narrow set of infrastructure providers means that a single architectural flaw can ripple across multiple independent brands simultaneously.

Decoding Custody Models

The industry’s terminology often obscures the legal reality of where money resides. An analysis of 18 major crypto card programs reveals five distinct custody models, ranging from direct debt claims to fully on-chain vaults:

1. Sale-to-Operator: Programs like KAST have adopted language that characterizes user deposits as a "sale" of assets to the company. In this model, the user holds a USD-denominated debt claim against the operator, often with limited liability protections and no guarantee of asset segregation in the event of bankruptcy.
2. Nominee Custody: Platforms like Revolut act as a "nominee" for the user. While the platform holds legal title, the user is defined as the beneficial owner. This model relies on the robustness of the platform’s balance sheet and the clarity of its insolvency procedures.
3. Fiat-Only Issuers: Many exchange-based cards, such as those from Crypto.com or Kraken, do not hold crypto assets on the card account at all. Crypto is held in exchange custody and converted to fiat only at the moment of a transaction. In the EU, this is governed by strict e-money safeguarding regulations.
4. Shared Program Pools: This is the category that suffered the August exploit. In this model, user collateral is held in a smart contract. While the user technically owns the collateral, the contract is managed by an operator with administrative upgrade keys. If the authorization logic is flawed, the "non-custodial" nature of the account provides no protection.
5. Self-Custodial Vaults: Programs like Gnosis Pay and Ether.fi Cash utilize sophisticated smart account architectures (such as Safe) where the user maintains control over their assets, often utilizing modules for spend permissions or time-delayed transactions. These are currently the most robust designs, though they are not immune to logic errors.

The Issuer Landscape: Beyond Traditional Banking

A significant finding in the current market structure is the role of "Third National." Seven of the programs analyzed—including Avici, KAST, and Ether.fi Cash—list Third National as their card issuer. Investigations reveal that Third National is not a chartered bank, but rather a Puerto Rico-based money transmitter operating under the corporate umbrella of Signify Holdings, Inc. (Rain).

This underscores a broader trend: many crypto-native card programs are built on non-bank infrastructure, utilizing stablecoin lending networks to facilitate settlement. When a user taps their card, Rain settles with the merchant via Visa and is subsequently repaid from the user’s collateral contract. This "charge card" model, financed by institutional stablecoin liquidity, is highly scalable but introduces dependencies on the creditworthiness and operational security of the underlying infrastructure provider.

The Regulatory Horizon and Future Outlook

The regulatory landscape is poised to change dramatically with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), effective July 2027. This framework will effectively prohibit anonymous crypto-asset accounts and limit the usage of anonymous prepaid cards. These impending rules are expected to force a consolidation in the market, favoring programs that maintain transparent KYC (Know Your Customer) and KYB (Know Your Business) compliance.

The recent failures of programs like Kulipa and the closure of Bit.Store following the revocation of its issuer’s license serve as reminders that card programs are fragile. Often, the decision to terminate a service is made by a sponsor bank or a network, leaving the consumer brand with little recourse.

Lessons from the August Incident

Despite the loss of $500,000, the August 28 incident had a relatively positive outcome for users. Rain and the affected programs, such as Avici and Tria, stepped in to refund all impacted users within 24 hours. This response highlights that, for now, the industry is operating on a model of "socialized risk," where venture-backed entities prioritize reputation and customer retention by covering losses out of their own balance sheets.

However, the event serves as a warning for the next phase of market development. As transaction volumes continue to grow, the industry can no longer rely on the promise of venture-backed refunds to mitigate smart contract risks. The path forward requires a transition toward more transparent, immutable, and fully audited on-chain vault architectures. For the end user, the lesson is clear: "non-custodial" is not a synonym for "invulnerable." Before topping up a card, users should look past the marketing, verify the issuer’s regulatory standing, and understand whether the smart contract holding their collateral is truly isolated or subject to the administrative whims of a single, centralized key.

As of September 2026, the sector stands at a crossroads. The integration of stablecoin-powered payments into the Visa network is a major technological milestone, but the infrastructure supporting this growth remains a work in progress. For the millions of users participating in this ecosystem, the security of their assets depends as much on the quality of the legal documentation and the strength of the multisig upgrade keys as it does on the underlying blockchain technology.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began draining balances from users of Avici, a prominent Solana-based neobank. While Avici’s legal documentation, last updated on June 23, 2025, explicitly stated that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," this contractual language failed to protect the underlying assets. By the time the incident was resolved, 1,685 users had seen their accounts compromised, resulting in a collective loss of $500,859.22. The funds were siphoned from a smart contract architecture utilized not only by Avici but by several other programs, all of which relied on infrastructure provided by Rain, the dominant firm in the self-custodial card market.

The breach was not a traditional theft of private keys, nor was it a compromise of individual user wallets. Instead, the vulnerability lay within the central "program manager" contract—a mechanism designed to be non-custodial but which nonetheless contained a single, plain signing key capable of upgrading the contract’s logic. This event has cast a spotlight on the fragility of the "non-custodial" card category, which has seen transaction volumes nearly double since the spring of 2026, even as the industry grapples with the collapse of large issuers and the revocation of electronic money institution (EMI) licenses.

Chronology of the August 28 Exploit

The attacker’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained largely inactive for nearly three hours following its funding. At 16:49:48 UTC, the first exploit transaction was broadcast. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 resulting in successful fund transfers.

The exploit utilized a sophisticated authorization bug in the Rain-controlled Solana programs. By leveraging a native Ed25519 signature-verification instruction, the attacker forced the program to accept a single signature as valid for a two-signature requirement. This allowed the attacker to grant themselves "collateral admin" privileges on over 1,000 individual user accounts. Once administrative control was established, the withdrawal of funds became a trivial matter. The median loss per user was approximately $24, though some accounts saw significantly higher depletion, with the largest individual loss reaching $5,268.

The incident response was rapid but largely private. By 19:18:37 UTC, just fifteen seconds before the attacker’s final malicious transaction, Rain had pushed a patch to the most severely affected program. The remaining programs were updated by 19:43:42 UTC. By September 5, Rain had migrated the upgrade authority for all three compromised programs to a more secure Squads multisig vault (7MoSDo66QknjsyE8yX9VnsrbGj4cQTDYVjo2JHLt5RSL), finally closing the door on the vulnerability.

The Landscape of Crypto Card Volume

According to data from Paymentscan, total crypto card volume in August 2026 reached $1.116 billion, spanning 11 million transactions and over 287,000 active addresses. This marks the second consecutive month that volume has exceeded the $1 billion threshold. Since March 2023, cumulative volume in this sector has surpassed $11.6 billion, reflecting a 32% growth rate since March 2026 when adjusted for restated figures and improved data tracking.

However, these figures carry significant caveats. A large portion of this volume is "self-reported" by operators rather than verified on-chain. For instance, RedotPay—the largest card program by volume—accounted for $403.6 million in August, or roughly 36% of the industry total. Because Paymentscan tracks top-ups on-chain but relies on internal company data for spend, the true nature of liquidity remains opaque. Programs such as Ether.fi Cash, which allow for full on-chain visibility of every purchase, provide a more transparent, albeit smaller, data set. Ether.fi Cash processed $109.5 million in August, crossing the milestone of 10 million total transactions.

Understanding Custody Models

The industry is currently divided into five distinct custody models, each with varying degrees of legal and technical risk.

1. Sold to the Operator: Programs like KAST have moved toward a "sale" model where the user’s crypto assets are legally transferred to the company in exchange for a USD-denominated debt claim. In the event of bankruptcy, users are treated as general creditors.
2. Held in Custody for You: This model, used by RedotPay and major exchanges like Coinbase, involves the operator holding assets on the user’s behalf. While legally distinct from the operator’s treasury, the enforceability of these claims in bankruptcy remains untested in many jurisdictions.
3. Converted to Fiat at Licensed Issuers: Companies like Crypto.com and Kraken convert crypto to fiat at the point of sale. In the EU and UK, these fiat funds are often "safeguarded" under e-money regulations, providing a layer of protection against institutional insolvency.
4. Smart Contract Pools: Programs like Avici and Tria allow users to maintain their own contracts, but these contracts are managed within a pool administered by a third party like Rain. This was the model compromised in August.
5. Direct Vault/JIT Debit: The most robust model, used by Gnosis Pay and Bridge, involves a self-custodial smart account that the operator cannot move. Spend permissions are strictly scoped, and the operator only pulls the exact amount required at the moment of authorization.

The "Third National" Concentration Risk

A significant systemic vulnerability is the high level of concentration in card issuing. Seven of the 18 programs analyzed—KAST, Avici, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria—name "Third National" as their issuer. Investigation reveals that Third National is not a bank in the traditional sense, but a brand name for Nimbus LLC, a Puerto Rico-licensed money transmitter and an affiliate of Rain.

Rain acts as the central hub, facilitating settlement through a network of capital partners who borrow stablecoins to cover card receivables. While this model allows for rapid scaling, it introduces a "single point of failure" for the infrastructure. If the issuer’s license is revoked or the network mandates a shutdown, multiple card programs could be rendered unusable simultaneously.

Implications and Regulatory Outlook

The August 28 exploit demonstrated that "non-custodial" marketing often masks the reality of centralized control over smart contract upgrade keys. While Avici and Rain successfully made all affected users whole, the recovery was funded by the companies’ own balance sheets, not by any inherent feature of the underlying protocol.

The industry is also bracing for the implementation of the EU’s Anti-Money Laundering Regulation (AMLR) in 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and restrict the use of anonymous prepaid cards. As supervisors tighten their grip, the era of "no-KYC" cards appears to be reaching its end. Many of these services have already faced sudden shutdowns or BIN freezes as regulators and card networks prioritize compliance over the privacy features previously marketed to users.

Conclusion

The incident highlights a critical distinction between technical self-custody and legal protection. Even if a user retains their private keys, the smart contract governing their card spend may still be susceptible to administrative interference or design flaws. As the crypto card market continues to scale—now handling over $1 billion monthly—users must look beyond marketing buzzwords. They must scrutinize who holds the upgrade authority for their contracts, who the legal issuer is, and what happens to their assets in the event of an institutional insolvency.

For now, the sector remains in a state of rapid, often chaotic, evolution. The success of programs like Ether.fi Cash and Gnosis Pay suggests a path toward more secure, transparent architectures, but the concentration of risk within Rain-led programs indicates that systemic vulnerabilities remain a central concern for the next phase of the industry’s growth. The lesson from August 2026 is clear: in the world of crypto-native finance, where the money sits and who controls the code matters far more than the promise of being "non-custodial."