inside

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in bridged USDC—began a systematic extraction of funds from card-balance accounts managed by Avici, a prominent Solana-based neobank. This event, which lasted roughly two and a half hours, served as a stark reminder of the underlying vulnerabilities within the rapidly expanding "non-custodial" crypto debit card sector. By the time the final transaction occurred at 19:18:52 UTC, 1,685 users had seen a combined $500,859.22 vanish from a smart contract infrastructure shared by several programs, including Avici and Tria.

The incident was not a result of compromised user keys or illicit wallet access. Rather, the vulnerability resided in the very architecture that proponents often cite as the hallmark of safety: a specialized smart contract designed for card collateral. These contracts, while ostensibly user-controlled, are frequently subject to administrative upgrade paths that rely on single signing keys. This centralized control, combined with a signature-verification flaw, allowed the attacker to grant themselves administrative privileges over individual user accounts, effectively bypassing the security models that users believed were protecting their assets.

The Chronology of the August 28 Exploit

The precision of the attack suggests a sophisticated understanding of the target’s technical debt. The attacker’s wallet, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, performed 21,405 transactions during the exploit window, with 17,500 succeeding. Each success followed a three-step sequence against a Rain-controlled Solana program: an initial SubmitSignatures call utilizing a native Ed25519 signature-verification instruction, followed by an AddCollateralAdmin call, and concluding with a WithdrawCollateralAsset command.

The critical failure involved a faulty verification instruction that directed signature and message offsets back at the initial call, allowing a single signature to satisfy a two-signature requirement. This oversight effectively turned the attacker into a "collateral admin" for thousands of accounts. By 19:03:18 UTC, while the exploit was ongoing, the attacker initiated a deBridge order to move over 1 million USDC from Solana to Ethereum, which was subsequently funneled through Tornado Cash in standard mixing increments.

Rain, the card-issuing infrastructure provider behind these programs, responded by patching the affected Solana programs between 19:18 UTC and 19:43 UTC. On September 5, 2026, Rain transitioned the upgrade authority for these programs to a Squads multisig vault, a critical security improvement that was not publicly announced but was verified via on-chain analysis on September 10.

The Scale of the Crypto Card Market

Data from Paymentscan indicates that the crypto card market has entered a period of hyper-growth, with August 2026 volume reaching $1.116 billion across 11 million transactions. This represents a significant shift from the $153 million recorded in December 2024. While these figures reflect a maturing industry, they also mask significant complexities regarding how funds are actually held.

Paymentscan identifies five distinct custody models, ranging from "Sold to the Operator"—where the user holds only a debt claim against the issuer—to "Your Own Vault," where funds remain in a self-custodial smart contract debited only at the moment of authorization. The industry remains highly concentrated; Rain alone facilitates settlement for roughly 42% of the market’s total volume. When combined with RedotPay’s self-reported figures, just two entities account for approximately 78% of the total tracked volume. This concentration creates a systemic risk profile where a single technical failure in a shared codebase can affect dozens of seemingly disparate brands simultaneously.

The Myth of Non-Custodial Security

The term "non-custodial" has become a marketing imperative in the crypto card space, yet its legal and technical definitions vary wildly. Avici’s terms of service, last updated in June 2025, assured users that the company would never hold custody of collateral. While legally accurate, this statement provided little comfort to the 1,685 users whose funds were drained due to a flaw in the underlying Rain-managed contract.

This gap between marketing and mechanism is exemplified by programs like Solayer, which markets its Emerald card as "fully on-chain" while its internal security documentation reveals the use of offline, multisig-protected cold storage. This is, by definition, a custodial arrangement. The industry’s reliance on "Third National"—a Puerto Rican money transmitter and Rain affiliate—as an issuer for seven major programs further highlights the distance between the "DeFi" ethos and the reality of traditional financial infrastructure. These cards are effectively charge cards financed by borrowed stablecoins, not the seamless, on-chain experiences often depicted in promotional materials.

Regulatory and Institutional Implications

The regulatory landscape is set to undergo a fundamental shift with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) in July 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions. For the "no-KYC" card sector, this presents an existential threat. Currently, these services exploit the gap between "Know Your Business" (KYB) verification for the issuer and the lack of individual KYC for the cardholder.

Recent infrastructure failures—such as the collapse of the Kulipa program in July 2026, which abruptly ended services for Ready, Argent, and Solflare—demonstrate that the primary risk to users is often not a hack, but rather the fragility of the underlying business relationships. When issuers like Paytend have their licenses revoked or programs like Fiat24 pause operations to address compliance gaps, the brand the consumer interacts with is often left powerless to assist.

Official Responses and Remediation

The response to the August 28 exploit was swift, if opaque. Avici and Tria, recognizing the reputational damage at stake, opted to cover the losses out of their own balance sheets, with Avici explicitly stating that Rain funded the refunds. The total impact, approximately $1.1 million, was mitigated for the end-user within 24 hours. However, the incident highlighted a dangerous lack of transparency regarding pre-deployment audits. While Rain claims to use Sherlock for audits, the drained contracts were older versions that remained live—a classic "legacy code" vulnerability that audit-at-deployment models fail to address.

Ether.fi Cash remains a notable outlier in the category. By utilizing a public, address-verified vault on Optimism and maintaining clear documentation on its CashModule contract, it offers a level of transparency that is currently the exception, not the rule. The contrast between Ether.fi’s architecture and the shared, opaque collateral pools of other programs is a lesson in the importance of technical due diligence over marketing claims.

Moving Forward: What Users Should Analyze

For the end-user, the August 2026 events suggest five critical questions that must be addressed before depositing funds into any crypto-linked card:

1. Custody Classification: Does the contract transfer ownership to the operator, or is it a true self-custodial vault?
2. Issuer Identity: Is the issuer a chartered bank, an EMI, or an offshore money transmitter? If the issuer is not clearly named, the program should be viewed as high-risk.
3. Insolvency Protection: What happens if the service provider goes bankrupt? If the terms do not explicitly address the status of user funds in an insolvency event, users should assume they are unsecured creditors.
4. Upgrade Authority: Who holds the keys to upgrade the contract? If a single private key controls the contract, the "non-custodial" nature of the product is largely performative.
5. Transparency of Metrics: Are volume and spend metrics verifiable on-chain, or are they self-reported numbers that lack independent oversight?

The rapid expansion of the crypto card market in 2026 has provided users with unprecedented convenience, but it has also introduced a level of technical and systemic risk that the current marketing landscape fails to articulate. While the August 28 exploit ended with users being made whole, the next failure may not be supported by a $338 million venture-backed balance sheet. As the industry approaches the 2027 regulatory deadline, the divergence between robust, transparent platforms and those relying on "nuanced loopholes" will likely accelerate, forcing a consolidation that favors transparency and structural integrity over the current proliferation of proprietary, black-box solutions.

The reliance on a single company to manage nearly half of the market’s settlement volume creates a "too-big-to-fail" scenario that contradicts the decentralization tenets of the blockchain ecosystem. Ultimately, the stability of the crypto card market in the coming years will depend less on the cleverness of its smart contract marketing and more on the regulatory and technical rigor of the institutions standing behind the cards. Until that time, the user is left to navigate a landscape where "non-custodial" is a description of the current state of a contract, rather than a guarantee of future security.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based wallet—funded just three hours prior with 1.79 SOL via a bridge from Ethereum—executed the first of over 21,000 transactions that would systematically drain thousands of user accounts belonging to Avici, a prominent Solana-focused neobank. By the time the incident concluded, 1,685 users had seen their balances liquidated, totaling $500,859.22 in losses. This breach was not a result of compromised private keys or standard phishing; rather, it exploited a critical vulnerability in a shared smart contract architecture used by Avici and several other programs within the burgeoning self-custodial crypto card market.

The incident highlights a growing tension in the financial technology sector: the gap between the marketing promise of "non-custodial" finance and the technical reality of how these assets are governed. While Avici’s terms of service explicitly stated that the company would not hold custody of user collateral, the underlying smart contract infrastructure—managed by the card-issuing company Rain—contained an authorization flaw that allowed an attacker to bypass security checks. This event has forced a broader audit of the $1.1 billion monthly crypto card industry, raising questions about transparency, issuer reliance, and the legal status of digital assets in the event of platform failure.

The Anatomy of the August 28 Breach

The attack vector was surgically precise. The perpetrator’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, targeted a vulnerability in the signature-verification instruction of a Rain-controlled Solana program. By manipulating signature and message offsets, the attacker effectively tricked the program into accepting a single signature as the required dual-authorization for administrative actions. Once the attacker granted themselves "Collateral Admin" status, they were able to initiate asset withdrawals from individual user accounts.

The chronology of the event reveals the speed at which modern on-chain exploits unfold. The initial exploit began at 16:49:48 UTC, and the final malicious transaction was recorded at 19:18:52 UTC. In the interim, the attacker managed to successfully process approximately 17,500 transactions. By 19:03:18 UTC, while the drain was still in progress, the attacker initiated a series of deBridge orders to move approximately 1.1 million USDC from the Solana network to Ethereum. These funds were subsequently funneled into Tornado Cash in a standard "laddered" withdrawal pattern, effectively obscuring the trail of the stolen capital.

Rain’s response was rapid but highlighted the centralized nature of what is often marketed as decentralized infrastructure. The company patched the affected Solana programs between 19:18 and 19:43 UTC, mere minutes after the drain concluded. Following the patch, Rain and the affected programs, including Avici and Tria, committed to full refunds. While this prevented a public relations catastrophe, it underscored a reality that the industry rarely discusses: the "non-custodial" cardholder was ultimately saved by the corporate balance sheet of a venture-backed firm, not by the inherent security of the blockchain itself.

The State of the Crypto Card Market: $1.1 Billion and Counting

According to data from Paymentscan, the crypto card industry has seen explosive growth. As of August 2026, monthly transaction volume hit $1.116 billion across 11 million individual transactions and nearly 290,000 active addresses. This marks the second consecutive month that the sector has exceeded the billion-dollar milestone, following a steady climb from $153 million in December 2024.

However, these figures carry significant caveats. A substantial portion of this volume—nearly 42%—is routed through Rain, which acts as the infrastructure provider for numerous smaller programs. Furthermore, the reliance on self-reported data from major players like RedotPay makes it difficult to ascertain the true level of risk within the ecosystem. When adjusting for on-chain verifiable spend, the actual figures are closer to $545 million, representing a 55% increase since March 2026. This discrepancy highlights the lack of standardized reporting in the crypto payments space, where market share is often conflated with user activity.

The Custody Spectrum: Five Models of Risk

To understand why some cards were vulnerable while others remained secure, one must look at the legal and technical "custody models" currently in operation. The industry generally falls into five distinct categories, ranging from total loss of ownership to true self-custody.

1. Sold to the Operator: In this model, such as that employed by KAST, the user’s deposit is legally considered a sale of assets. The user no longer owns the cryptocurrency but instead holds a debt claim against the platform. In the event of a bankruptcy, these users are merely unsecured creditors.
2. Held in Custody: Platforms like RedotPay and Revolut act as custodians. While they claim to hold assets for the user, these assets are often subject to general liens and may be reachable by the platform’s creditors during insolvency proceedings.
3. Fiat Conversion: Exchange-based cards, such as those from Crypto.com or Kraken, often do not hold crypto on the card at all. Assets are converted to fiat at the moment of the transaction, and the fiat is held in regulated bank accounts. While this offers the most protection, it is dependent on the regulatory status of the bank, not the security of the blockchain.
4. Program-Managed Smart Contracts: This was the model utilized by Avici and Tria. The collateral sits in a smart contract. While the user technically owns the assets, the "upgrade authority"—the power to change the rules of the contract—is often held by the program manager (in this case, Rain). The August breach occurred because this authority was centralized, not distributed.
5. Direct Authorization Vaults: Gnosis Pay and Ether.fi Cash represent the most secure tier. Here, the user retains control over a smart contract (a "Safe") where funds remain until an authorization is explicitly signed. Even if the program manager fails, the user’s assets remain in their own vault, inaccessible to the provider.

The "Third National" Concentration Risk

A significant systemic risk identified in the 2026 data is the concentration of issuers. Seven major programs—KAST, Avici, Ether.fi, Plasma One, Solayer, Payy, and Tria—all name "Third National" as their card issuer. Investigations reveal that Third National is not a bank in the traditional sense, but a Puerto Rico-based money transmitter and a subsidiary of Signify Holdings (Rain).

This creates a "single point of failure" scenario. When an infrastructure provider like Rain faces a technical exploit, the impact is not isolated to one brand but ripples across the entire portfolio of programs that rely on their shared codebase. The August incident demonstrated that while the brands appear distinct to the consumer, they are fundamentally tethered to the same administrative keys and contract logic.

Regulatory Horizons and Future Implications

The industry is currently facing a dual challenge: increasing regulatory scrutiny and the natural consolidation of infrastructure. With the European Union’s Anti-Money Laundering Regulation (EU 2024/1624) set to take full effect in July 2027, the era of anonymous, no-KYC crypto cards is nearing an end. The new rules effectively ban anonymous prepaid cards loaded with crypto, forcing providers to either implement rigorous identity verification or face exclusion from EU merchant terminals.

For the self-custodial sector, the lessons of August 2026 are clear. "Non-custodial" is a marketing term that fails to describe the reality of governance. The security of a card program is not merely about whether the user holds their private keys, but about who holds the upgrade keys to the smart contracts, whether those contracts have been audited for the specific version currently in production, and how the program is financed.

As the industry matures, the survivors will likely be those who can provide the highest degree of technical transparency. Ether.fi and Gnosis Pay have set a new standard by publishing contract addresses and governance modules, allowing users to verify for themselves where their money sits. In contrast, programs that hide behind opaque "licensed partners" and "proprietary infrastructure" remain inherently vulnerable.

Ultimately, the August exploit serves as a stark reminder that while the blockchain provides a ledger of truth, the surrounding financial infrastructure—the bridges, the issuers, and the administrative authorities—is only as robust as its weakest line of code. For the 1,685 users who were made whole, the experience was a fortunate reprieve. For the industry, it is a definitive call to move away from centralized "non-custodial" templates toward architectures that truly prioritize user sovereignty over administrative convenience.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began systematically draining card-balance accounts held by users of Avici, a prominent Solana-based neobank. By the time the exploit was neutralized, 1,685 users had seen their balances liquidated, totaling a loss of $500,859.22. This incident, while rapidly contained, has cast a harsh spotlight on the "non-custodial" crypto card market, a sector that has seen its monthly transaction volume explode to over $1.1 billion as of August 2026.

The vulnerability did not stem from stolen private keys or compromised user devices. Instead, it lay within a specific Solana card contract shared by Avici and several other programs. The underlying infrastructure belongs to Rain, a card-issuing company that has become the backbone of much of the self-custodial card market. While Avici’s terms of service, last updated in June 2025, assured users that neither the company nor the issuer held custody of their collateral, the technical reality of the smart contract architecture allowed for a systemic failure. The incident serves as a stark reminder that in the world of crypto-native finance, the definition of "non-custodial" is often dictated by the nuance of smart contract permissions rather than the absolute security of user assets.

A Chronology of the August Drain

The exploit was surgical and efficient. The attacker’s wallet, identified on-chain as 0xFVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching its first attack at 16:49:48 UTC. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 successfully interacting with the Rain-controlled Solana program.

The mechanics of the exploit relied on an authorization bug within the SubmitSignatures call. By manipulating the signature-verification instruction—pointing the signature, key, and message offsets back at one another—the attacker managed to satisfy a two-signature check with only a single signature. This granted the attacker administrative status over individual user collateral accounts, allowing for the immediate withdrawal of funds.

The fallout was swift. Between 19:03 and 19:49 UTC, as the drain was concluding, the stolen funds were bridged from Solana to Ethereum and moved through Tornado Cash. By 19:18 UTC, Rain had begun patching the affected programs. By September 5, all upgrade authorities for the involved contracts were successfully migrated to a Squads multisig vault, providing a long-term fix to the security architecture.

Market Growth and Concentration Risks

According to data from Paymentscan, the crypto card market has witnessed extraordinary growth, rising from $153 million in monthly volume in December 2024 to $1.116 billion by August 2026. This trajectory highlights a significant shift in consumer behavior, as users increasingly seek to bridge the gap between volatile digital assets and daily retail spending.

However, this growth is heavily concentrated. Paymentscan’s issuer mapping attributes approximately 42% of August’s total volume—$468 million—to programs settling through Rain. When combined with the self-reported figures from RedotPay, these two entities facilitate roughly 78% of the entire tracked crypto card market. This concentration presents a systemic risk: while the August exploit was limited to specific Solana contracts, the reliance on a narrow set of infrastructure providers means that a single architectural flaw can ripple across multiple independent brands simultaneously.

Decoding Custody Models

The industry’s terminology often obscures the legal reality of where money resides. An analysis of 18 major crypto card programs reveals five distinct custody models, ranging from direct debt claims to fully on-chain vaults:

1. Sale-to-Operator: Programs like KAST have adopted language that characterizes user deposits as a "sale" of assets to the company. In this model, the user holds a USD-denominated debt claim against the operator, often with limited liability protections and no guarantee of asset segregation in the event of bankruptcy.
2. Nominee Custody: Platforms like Revolut act as a "nominee" for the user. While the platform holds legal title, the user is defined as the beneficial owner. This model relies on the robustness of the platform’s balance sheet and the clarity of its insolvency procedures.
3. Fiat-Only Issuers: Many exchange-based cards, such as those from Crypto.com or Kraken, do not hold crypto assets on the card account at all. Crypto is held in exchange custody and converted to fiat only at the moment of a transaction. In the EU, this is governed by strict e-money safeguarding regulations.
4. Shared Program Pools: This is the category that suffered the August exploit. In this model, user collateral is held in a smart contract. While the user technically owns the collateral, the contract is managed by an operator with administrative upgrade keys. If the authorization logic is flawed, the "non-custodial" nature of the account provides no protection.
5. Self-Custodial Vaults: Programs like Gnosis Pay and Ether.fi Cash utilize sophisticated smart account architectures (such as Safe) where the user maintains control over their assets, often utilizing modules for spend permissions or time-delayed transactions. These are currently the most robust designs, though they are not immune to logic errors.

The Issuer Landscape: Beyond Traditional Banking

A significant finding in the current market structure is the role of "Third National." Seven of the programs analyzed—including Avici, KAST, and Ether.fi Cash—list Third National as their card issuer. Investigations reveal that Third National is not a chartered bank, but rather a Puerto Rico-based money transmitter operating under the corporate umbrella of Signify Holdings, Inc. (Rain).

This underscores a broader trend: many crypto-native card programs are built on non-bank infrastructure, utilizing stablecoin lending networks to facilitate settlement. When a user taps their card, Rain settles with the merchant via Visa and is subsequently repaid from the user’s collateral contract. This "charge card" model, financed by institutional stablecoin liquidity, is highly scalable but introduces dependencies on the creditworthiness and operational security of the underlying infrastructure provider.

The Regulatory Horizon and Future Outlook

The regulatory landscape is poised to change dramatically with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), effective July 2027. This framework will effectively prohibit anonymous crypto-asset accounts and limit the usage of anonymous prepaid cards. These impending rules are expected to force a consolidation in the market, favoring programs that maintain transparent KYC (Know Your Customer) and KYB (Know Your Business) compliance.

The recent failures of programs like Kulipa and the closure of Bit.Store following the revocation of its issuer’s license serve as reminders that card programs are fragile. Often, the decision to terminate a service is made by a sponsor bank or a network, leaving the consumer brand with little recourse.

Lessons from the August Incident

Despite the loss of $500,000, the August 28 incident had a relatively positive outcome for users. Rain and the affected programs, such as Avici and Tria, stepped in to refund all impacted users within 24 hours. This response highlights that, for now, the industry is operating on a model of "socialized risk," where venture-backed entities prioritize reputation and customer retention by covering losses out of their own balance sheets.

However, the event serves as a warning for the next phase of market development. As transaction volumes continue to grow, the industry can no longer rely on the promise of venture-backed refunds to mitigate smart contract risks. The path forward requires a transition toward more transparent, immutable, and fully audited on-chain vault architectures. For the end user, the lesson is clear: "non-custodial" is not a synonym for "invulnerable." Before topping up a card, users should look past the marketing, verify the issuer’s regulatory standing, and understand whether the smart contract holding their collateral is truly isolated or subject to the administrative whims of a single, centralized key.

As of September 2026, the sector stands at a crossroads. The integration of stablecoin-powered payments into the Visa network is a major technological milestone, but the infrastructure supporting this growth remains a work in progress. For the millions of users participating in this ecosystem, the security of their assets depends as much on the quality of the legal documentation and the strength of the multisig upgrade keys as it does on the underlying blockchain technology.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began draining balances from users of Avici, a prominent Solana-based neobank. While Avici’s legal documentation, last updated on June 23, 2025, explicitly stated that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," this contractual language failed to protect the underlying assets. By the time the incident was resolved, 1,685 users had seen their accounts compromised, resulting in a collective loss of $500,859.22. The funds were siphoned from a smart contract architecture utilized not only by Avici but by several other programs, all of which relied on infrastructure provided by Rain, the dominant firm in the self-custodial card market.

The breach was not a traditional theft of private keys, nor was it a compromise of individual user wallets. Instead, the vulnerability lay within the central "program manager" contract—a mechanism designed to be non-custodial but which nonetheless contained a single, plain signing key capable of upgrading the contract’s logic. This event has cast a spotlight on the fragility of the "non-custodial" card category, which has seen transaction volumes nearly double since the spring of 2026, even as the industry grapples with the collapse of large issuers and the revocation of electronic money institution (EMI) licenses.

Chronology of the August 28 Exploit

The attacker’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained largely inactive for nearly three hours following its funding. At 16:49:48 UTC, the first exploit transaction was broadcast. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 resulting in successful fund transfers.

The exploit utilized a sophisticated authorization bug in the Rain-controlled Solana programs. By leveraging a native Ed25519 signature-verification instruction, the attacker forced the program to accept a single signature as valid for a two-signature requirement. This allowed the attacker to grant themselves "collateral admin" privileges on over 1,000 individual user accounts. Once administrative control was established, the withdrawal of funds became a trivial matter. The median loss per user was approximately $24, though some accounts saw significantly higher depletion, with the largest individual loss reaching $5,268.

The incident response was rapid but largely private. By 19:18:37 UTC, just fifteen seconds before the attacker’s final malicious transaction, Rain had pushed a patch to the most severely affected program. The remaining programs were updated by 19:43:42 UTC. By September 5, Rain had migrated the upgrade authority for all three compromised programs to a more secure Squads multisig vault (7MoSDo66QknjsyE8yX9VnsrbGj4cQTDYVjo2JHLt5RSL), finally closing the door on the vulnerability.

The Landscape of Crypto Card Volume

According to data from Paymentscan, total crypto card volume in August 2026 reached $1.116 billion, spanning 11 million transactions and over 287,000 active addresses. This marks the second consecutive month that volume has exceeded the $1 billion threshold. Since March 2023, cumulative volume in this sector has surpassed $11.6 billion, reflecting a 32% growth rate since March 2026 when adjusted for restated figures and improved data tracking.

However, these figures carry significant caveats. A large portion of this volume is "self-reported" by operators rather than verified on-chain. For instance, RedotPay—the largest card program by volume—accounted for $403.6 million in August, or roughly 36% of the industry total. Because Paymentscan tracks top-ups on-chain but relies on internal company data for spend, the true nature of liquidity remains opaque. Programs such as Ether.fi Cash, which allow for full on-chain visibility of every purchase, provide a more transparent, albeit smaller, data set. Ether.fi Cash processed $109.5 million in August, crossing the milestone of 10 million total transactions.

Understanding Custody Models

The industry is currently divided into five distinct custody models, each with varying degrees of legal and technical risk.

1. Sold to the Operator: Programs like KAST have moved toward a "sale" model where the user’s crypto assets are legally transferred to the company in exchange for a USD-denominated debt claim. In the event of bankruptcy, users are treated as general creditors.
2. Held in Custody for You: This model, used by RedotPay and major exchanges like Coinbase, involves the operator holding assets on the user’s behalf. While legally distinct from the operator’s treasury, the enforceability of these claims in bankruptcy remains untested in many jurisdictions.
3. Converted to Fiat at Licensed Issuers: Companies like Crypto.com and Kraken convert crypto to fiat at the point of sale. In the EU and UK, these fiat funds are often "safeguarded" under e-money regulations, providing a layer of protection against institutional insolvency.
4. Smart Contract Pools: Programs like Avici and Tria allow users to maintain their own contracts, but these contracts are managed within a pool administered by a third party like Rain. This was the model compromised in August.
5. Direct Vault/JIT Debit: The most robust model, used by Gnosis Pay and Bridge, involves a self-custodial smart account that the operator cannot move. Spend permissions are strictly scoped, and the operator only pulls the exact amount required at the moment of authorization.

The "Third National" Concentration Risk

A significant systemic vulnerability is the high level of concentration in card issuing. Seven of the 18 programs analyzed—KAST, Avici, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria—name "Third National" as their issuer. Investigation reveals that Third National is not a bank in the traditional sense, but a brand name for Nimbus LLC, a Puerto Rico-licensed money transmitter and an affiliate of Rain.

Rain acts as the central hub, facilitating settlement through a network of capital partners who borrow stablecoins to cover card receivables. While this model allows for rapid scaling, it introduces a "single point of failure" for the infrastructure. If the issuer’s license is revoked or the network mandates a shutdown, multiple card programs could be rendered unusable simultaneously.

Implications and Regulatory Outlook

The August 28 exploit demonstrated that "non-custodial" marketing often masks the reality of centralized control over smart contract upgrade keys. While Avici and Rain successfully made all affected users whole, the recovery was funded by the companies’ own balance sheets, not by any inherent feature of the underlying protocol.

The industry is also bracing for the implementation of the EU’s Anti-Money Laundering Regulation (AMLR) in 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and restrict the use of anonymous prepaid cards. As supervisors tighten their grip, the era of "no-KYC" cards appears to be reaching its end. Many of these services have already faced sudden shutdowns or BIN freezes as regulators and card networks prioritize compliance over the privacy features previously marketed to users.

Conclusion

The incident highlights a critical distinction between technical self-custody and legal protection. Even if a user retains their private keys, the smart contract governing their card spend may still be susceptible to administrative interference or design flaws. As the crypto card market continues to scale—now handling over $1 billion monthly—users must look beyond marketing buzzwords. They must scrutinize who holds the upgrade authority for their contracts, who the legal issuer is, and what happens to their assets in the event of an institutional insolvency.

For now, the sector remains in a state of rapid, often chaotic, evolution. The success of programs like Ether.fi Cash and Gnosis Pay suggests a path toward more secure, transparent architectures, but the concentration of risk within Rain-led programs indicates that systemic vulnerabilities remain a central concern for the next phase of the industry’s growth. The lesson from August 2026 is clear: in the world of crypto-native finance, where the money sits and who controls the code matters far more than the promise of being "non-custodial."

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based wallet—funded just three hours prior with 1.79 SOL via a bridge from Ethereum—initiated a series of transactions that would expose a critical vulnerability in the architecture of modern "non-custodial" banking. By the time the dust settled, 1,685 users of Avici, a prominent Solana neobank, had seen their card-balance accounts drained of $500,859.22. This incident was not merely a local technical failure; it served as a jarring wake-up call for the rapidly expanding $1.1 billion-a-month crypto card industry, highlighting the precarious gap between the marketing of "self-custody" and the reality of underlying smart contract infrastructure.

The drain originated from a "Solana card contract" shared by Avici and a limited number of other programs, all managed by Rain, the infrastructure powerhouse behind a significant portion of the self-custodial card market. While Avici’s terms of service, last updated in June 2025, assured users that the platform would "not, in any circumstance, be holding custody of your Collateral," the reality proved more complex. While the company technically did not hold the funds in a traditional custodial sense, the design of the smart contract allowed for an administrative override that circumvented user security.

A Chronology of the August Drain

The attack followed a precise, automated cadence. The attacker’s wallet (FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj) remained dormant for approximately three hours after funding. At 16:49:48 UTC, it launched the first of 21,405 exploit transactions. Using a signature-verification flaw in the Rain-controlled Solana program, the attacker exploited the SubmitSignatures instruction. By carefully manipulating the Ed25519 signature-verification offsets, the attacker was able to trick the contract into accepting a single signature as valid for a two-signature check.

This flaw allowed the attacker to grant themselves "collateral admin" status on over a thousand individual user accounts. With administrative privileges, the attacker methodically executed WithdrawCollateralAsset calls. The median loss per user was relatively small—approximately $24—but the aggregate impact was significant. The exploit window remained open for two hours and 29 minutes, concluding at 19:18:52 UTC.

The movement of the stolen funds was equally sophisticated. Throughout the attack, the perpetrator utilized deBridge to move over $1.1 million in USDC from the Solana blockchain to Ethereum. By 19:49:23 UTC, the stolen assets were being funneled into the Tornado Cash mixer in a standardized ladder of 455.9 ETH. Despite the speed of the theft, the remediation efforts were equally rapid. Avici confirmed that Rain, as the program manager, covered every refund, with both Avici and the secondary program Tria contributing an additional 10% on top of the losses to restore user confidence.

The Anatomy of Crypto Card Custody

To understand how this occurred, one must categorize the five distinct models of custody currently dominating the 18 major programs surveyed. At one end of the spectrum is the "Sold to the Operator" model, exemplified by KAST. As of their July 2026 terms, KAST treats user asset transfers as a sale, granting the user a debt claim against the company rather than ownership of the underlying assets. This essentially places the user in the position of an unsecured creditor in the event of bankruptcy.

At the other end is the "Self-Custodial Vault" model used by programs like Gnosis Pay and Ether.fi Cash. These programs utilize smart accounts where the user retains control via their own keys, with spend permissions scoped specifically to the card. The August exploit occurred in the middle-ground: a "Contract Pool" model where users own the collateral in a smart contract, but the contract is written and managed by a central entity—in this case, Rain—which retains upgrade authority.

The vulnerability was not in the users’ private keys, but in the upgrade authority of the contract itself. Before the incident, the upgrade authority for the affected programs was held by a plain keypair, allowing for single-point-of-failure risks. Following the exploit, Rain migrated the upgrade authority for these programs to a Squads multisig vault on September 5, 2026, effectively closing the administrative backdoor.

Data and Market Concentration

Paymentscan data indicates that the crypto card market has seen an unprecedented surge, with August 2026 volume hitting $1.116 billion across 11 million transactions. However, this growth masks significant concentration. Approximately 42% of this volume is routed through programs settling via Rain. When combined with RedotPay, which reports its own spend metrics, two entities account for roughly 78% of the entire tracked market.

This concentration introduces systemic risk. The issuer behind seven of the programs surveyed—including KAST, Avici, Ether.fi, Plasma One, Solayer, Payy, and Tria—is "Third National." Crucially, Third National is not a traditional bank, but a Puerto Rico-based money transmitter. Rain’s own documentation clarifies that it does not provide FDIC insurance or hold deposits, but rather manages a network of capital partners who borrow stablecoins to facilitate card settlements. Essentially, the "non-custodial" card is a charge card financed by institutional debt, creating a layer of financial fragility that is rarely transparent to the average consumer.

Regulatory and Industry Implications

The regulatory environment is shifting to address these ambiguities. Regulation (EU) 2024/1624, set to apply from July 2027, will likely curtail the "no-KYC" (Know Your Customer) card model by prohibiting anonymous crypto-asset accounts and restricting the use of anonymous prepaid cards. Current no-KYC offerings, which often rely on business-entity verification to bypass individual identity checks, are increasingly finding themselves in the crosshairs of global regulators.

The industry has already seen the consequences of these regulatory pressures. The collapse of Paytend Europe UAB in March 2026, which led to the discontinuation of Bit.Store card services, demonstrates that when a regulator pulls an electronic money institution’s license, the brand the consumer interacts with is often powerless to retrieve user funds. The decision to shut down is rarely made by the consumer-facing app, but by the sponsor bank or the card network.

The Lessons of 2026

The August 28 incident provides three vital lessons for the future of decentralized finance. First, the term "non-custodial" is a legal and technical descriptor that often obscures the reality of who controls the contract’s upgrade authority. Even if a user holds their own keys, if the smart contract governing the collateral can be updated or bypassed by an administrator, the asset is not truly under the user’s absolute control.

Second, the distinction between "audited" and "deployed" code is a critical failure point. Rain’s contracts had undergone audits, but the specific, older versions deployed on the live programs were not covered by these checks. This highlights a need for rigorous lifecycle management in smart contract deployments, ensuring that legacy code is systematically patched or deprecated.

Finally, the resilience of the ecosystem is currently backed by venture capital, not by decentralized protocol security. The fact that users were made whole within 24 hours was a result of Rain’s balance sheet and corporate commitment, not the inherent safety of the smart contract code. While this protected the user base, it is an unsustainable model for long-term scalability. As the industry matures, the focus must shift from rapid growth and aggressive rewards toward verifiable, immutable custody models where upgrade authority is decentralized and the regulatory status of the issuer is beyond reproach.

For the consumer, the August event served as a stark reminder: the next time a card program touts its non-custodial credentials, the critical question is not who holds the keys, but who holds the keys to the code. Until the infrastructure is as decentralized as the marketing claims, these programs will remain subject to the same systemic risks that have plagued traditional finance for decades.