volume

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet, which had been funded just three hours earlier with 1.79 SOL—purchased with roughly $190 in USDC bridged from Ethereum—initiated a systematic drainage of card-balance accounts associated with Avici, a prominent Solana-based neobank. This breach, which persisted for over two hours, exposed the inherent risks hidden within the rapidly expanding "non-custodial" crypto card sector. By the time the incident was contained, 1,685 users had seen their balances liquidated, resulting in a total loss of $500,859.22.

The event serves as a stark case study in the gap between legal marketing and technical reality. Avici’s terms of service, last updated in June 2025, explicitly stated that neither the platform nor its issuer held custody of collateral. While legally accurate, the statement masked a technical vulnerability: the funds resided in a contract that, while nominally belonging to the user, remained under the administrative control of the program manager—a party capable of upgrading the contract with a single, plain signing key.

A Chronology of the Breach

The exploit was precise. The attacker’s wallet, identified by the address starting in "FVNFz," remained idle for 189 minutes after its initial funding before launching the attack. Between 16:49:48 and 19:18:52 UTC, the attacker executed approximately 21,405 transactions against a Solana-based program managed by Rain, the infrastructure provider powering the card.

The mechanics of the exploit exploited a flaw in signature verification. Each successful transaction involved a call to the native Ed25519 verification instruction. The attacker pointed the signature, key, and message offsets back at the initial instruction, allowing one signature to satisfy a check that required two. This granted the attacker administrative rights over individual user accounts, enabling the withdrawal of assets.

Rain, the card-issuing company behind Avici and several other programs, intervened by patching the affected contracts. The first patch was pushed at 19:18:37 UTC, just fifteen seconds before the final exploit transaction occurred. While the damage was significant, the immediate financial impact was mitigated by a prompt, company-led refund initiative. Avici and Tria—a second program hit by the same vulnerability—confirmed that all impacted users were made whole, with the companies absorbing the losses and providing an additional 10% premium to affected customers.

The Ecosystem: $1.1 Billion in Monthly Volume

The incident occurred against a backdrop of explosive growth for the crypto card industry. According to data from Paymentscan, the total monthly volume for crypto-linked cards reached $1.116 billion in August 2026, spanning 11 million transactions and nearly 288,000 active addresses. This marks the second consecutive month exceeding the $1 billion threshold.

However, these figures require nuance. The Paymentscan series has been restated to include previously unattributed issuer flows and to shift from on-chain top-up tracking to self-reported spend figures for platforms like RedotPay, which alone accounts for approximately 36% of the headline volume. When filtering for purely on-chain observable spend, the volume is closer to $545 million, reflecting a 55% increase since March 2026.

Concentration remains a critical structural factor. Nearly 42% of the total monthly volume is settled through Rain-affiliated programs. When combined with other major providers, a small cohort of companies facilitates over three-quarters of the entire tracked market. This concentration suggests that while the industry is scaling, it is also becoming increasingly reliant on a handful of underlying infrastructure providers.

The Five Custody Models

To understand the risk, one must categorize how these cards manage assets. Research into 18 leading programs reveals five distinct custody models, ranked from the weakest to the strongest user protection:

1. Sold to the Operator: In this model, as seen with KAST, assets transferred to the platform are legally considered sold to the company. The user essentially holds an unsecured debt claim against the operator.
2. Held in Custody for the User: Platforms like RedotPay and Revolut act as custodians. While legal title often remains with the user, these assets are typically subject to general liens and creditor claims in the event of insolvency.
3. Fiat Conversion at a Licensed Issuer: Programs like Crypto.com and Kraken convert crypto to fiat immediately upon sale. In the EU, these funds are subject to "safeguarding" regulations, which provide statutory protection against insolvency.
4. Program-Pool Smart Contracts: This model, utilized by Avici and Rain, places user funds in smart contracts. While "non-custodial" in spirit, the program manager often retains upgrade authority, as demonstrated by the August 28 exploit.
5. Self-Custodial Vaults: The strongest tier, exemplified by Gnosis Pay and Ether.fi, uses smart account modules that prevent the operator from accessing user funds, typically relying on time-locked modules or user-controlled multisig keys.

The "Third National" Connection

A significant portion of the self-custodial card market relies on an entity known as "Third National." While marketing materials often frame this as a bank, the entity is a Puerto Rico-based money transmitter and an affiliate of Signify Holdings (Rain).

The reliance on a non-bank issuer for credit-card-style settlement highlights the complexity of the "stablecoin-powered" payment model. When a user taps their card, Visa settles with the merchant, and Rain settles with Visa using borrowed stablecoin liquidity, later clawing back the funds from the user’s smart contract. This creates a reliance on institutional liquidity that, while efficient, introduces systemic risk if the underlying program manager faces operational or regulatory hurdles.

Regulatory and Structural Implications

The regulatory environment is shifting rapidly. With the European Union’s Anti-Money Laundering Regulation (Regulation 2024/1624) set to take effect in July 2027, the "no-KYC" (Know Your Customer) model faces a potential existential threat. The new rules effectively bar anonymous crypto-asset accounts and prohibit EU acquirers from processing transactions from anonymous prepaid cards issued in third-party jurisdictions.

The failure of the Gnosis Pay consumer interface in September 2026, alongside the winding down of other infrastructure providers like Kulipa and the loss of Paytend’s license, underscores the fragility of these programs. In many instances, the shutdown of a service is not decided by the consumer-facing brand, but by the underlying bank or payment network.

Lessons from the August Breach

The August 28 incident was not a failure of "self-custody" as a concept, but a failure of operational transparency. The users who lost funds held their own keys, but they relinquished control to a smart contract architecture where the upgrade authority was held by a single, centralized key—a detail that was not explicitly disclosed in user-facing documentation.

The fact that users were reimbursed is a testament to the venture-backed capital reserves of the platforms involved. However, relying on the benevolence of a private company to cover losses is a far cry from the technical, trustless guarantees promised by decentralized finance. As the sector matures, the focus must shift from marketing "non-custodial" status to providing verifiable audits of contract upgrade authorities, clear legal definitions of asset ownership during insolvency, and transparent reporting on the identity and regulatory standing of the card issuer.

The industry is clearly at an inflection point. As volume crosses the billion-dollar mark, the "black box" nature of card infrastructure—where users cannot see who holds the upgrade keys or how the settlement is financed—represents the most significant tail risk for the average consumer. For the 11 million transactions occurring monthly, the question remains: is the user a participant in a decentralized network, or simply a creditor to a new type of digital bank? The answer, as of late 2026, is that for most, it is the latter.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of transactions that would trigger a crisis for Avici, a prominent Solana-based neobank. By the time the dust settled, 1,685 users had been drained of $500,859.22. This incident was not a breach of individual private keys or a compromise of user wallets; rather, it was a structural failure within a shared smart contract infrastructure managed by Rain, the firm that serves as the card-issuing backbone for a significant portion of the self-custodial crypto card market.

The breach highlights the growing, often invisible complexity of the $1.1 billion-a-month crypto card industry. While marketing materials frequently tout these products as "non-custodial," the technical reality is far more nuanced. In the case of Avici, the funds were held in smart contracts that, while technically accessible to users, were subject to administrative authority that could be—and was—exploited.

A Chronology of the August Drain

The exploit was surgical and efficient. The attacker’s wallet, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching the attack. Between 16:49:48 UTC and 19:18:52 UTC, the wallet executed approximately 21,405 transactions against a Rain-controlled Solana program. Roughly 17,500 of these were successful.

Each successful transaction utilized a specific authorization loophole. The attacker performed a SubmitSignatures call paired with a native Ed25519 signature-verification instruction. By manipulating the signature, key, and message offsets, the attacker bypassed the program’s two-signature requirement, effectively tricking the smart contract into granting them "collateral admin" status. Once this status was achieved, the attacker systematically withdrew assets from over a thousand individual user accounts.

The impact was swift. By 19:03:18 UTC, while the drain was still in progress, the attacker utilized a deBridge order to move over $1 million in USDC to Ethereum. This was followed by a series of smaller swaps through Jupiter to convert the remaining 886.94 SOL. The total haul, approximately 1,113,096.76 USDC, was funneled into a single Ethereum address. Within less than thirty minutes of the final bridge, the funds were processed through the Tornado Cash mixer in a standard laddered sequence.

The Institutional Response

The resolution of the incident was as rapid as the theft. Because the affected programs—Avici, Tria, and Solayer—relied on Rain’s infrastructure, the response was coordinated at the issuer level. By 19:18:37 UTC, Rain had begun patching the most severely affected program. The remaining two were patched within thirty minutes.

Avici confirmed that all 1,685 affected users were fully reimbursed, with the capital provided by Rain and an additional 10% buffer added by the programs themselves. This rapid "make-whole" approach served to stabilize the ecosystem, but it also underscored a critical reality: the "non-custodial" nature of these cards is a spectrum. While the users held their keys, the underlying collateral was stored in a contract governed by an upgradeable key held by a private entity. When that entity—Rain—suffered a failure, the company’s own balance sheet became the insurance policy.

Data and Market Concentration

Paymentscan data for August 2026 illustrates the sheer scale of this sector. Total volume reached $1.116 billion across 11 million transactions, marking the second consecutive month above the billion-dollar threshold. However, this headline number requires careful interpretation. Approximately 42% of this volume, or $468 million, is tied to programs settling through Rain. When including RedotPay—which self-reports spend metrics—two entities effectively control nearly 78% of the tracked market.

This concentration of infrastructure creates systemic risk. The August incident proved that when a single issuer’s codebase is vulnerable, the failure propagates across multiple, seemingly distinct brands simultaneously. While Ether.fi Cash remained untouched, its isolation was not due to luck but to its specific architectural design, which utilizes individual, isolated vaults rather than a shared collateral pool managed by an overarching program administrator.

Custody Models: Five Tiers of Risk

To understand the risks, one must categorize how these programs hold value. The industry generally falls into five tiers:

1. Sold to the Operator: In this model, as seen with KAST, users essentially trade their crypto for a debt claim. Once the assets are transferred, the user no longer holds an ownership interest in the crypto but rather an enforceable claim against the operator’s corporate treasury.
2. Custodial Nominee: Platforms like Revolut and RedotPay hold assets on behalf of the user. While the user is the beneficial owner, the legal title rests with the platform, making the assets subject to the platform’s insolvency risk.
3. Fiat Conversion: Cards from major exchanges like Crypto.com or Kraken often do not hold crypto at all. Instead, the crypto is converted to fiat at the moment of sale, and the resulting fiat is held by a regulated e-money institution.
4. Program-Managed Collateral: This is the model used by Avici and Tria. Funds reside in smart contracts that are "non-custodial" in that they are not held in a central omnibus account, but they are subject to an administrator’s logic, which can be altered or exploited.
5. Vault-Based Self-Custody: Programs like Gnosis Pay and Ether.fi Cash represent the highest tier of security. Funds are held in individual smart contracts (Safes or Vaults) that are controlled by the user, with spend permissions strictly limited and automated by code rather than administrative decree.

The "No-KYC" Illusion

Parallel to the main market, a "no-KYC" card segment has proliferated, often operating in a regulatory gray area. These cards, frequently marketed as privacy-centric, often mask significant counterparty risks. An analysis of eleven such cards revealed that only one named its issuer. The majority rely on "licensed partners" or opaque corporate entities.

The mechanism, as reported by industry observers, typically involves a company completing "Know Your Business" (KYB) verification to act as a master account, which then issues cards to individuals. This approach is highly vulnerable to regulatory crackdowns. When the sponsor bank or network—such as Visa or the institution behind the BIN—decides to terminate the program, the brands themselves are often powerless to assist their users, as seen in the 2026 collapse of Bit.Store following the revocation of its issuer’s license.

Implications and Regulatory Horizon

The European Union’s Anti-Money Laundering Regulation (EU 2024/1624), set to take effect in July 2027, poses a significant threat to the anonymous prepaid card segment. By prohibiting the use of anonymous crypto-asset accounts and restricting the ability of EU acquirers to accept payments from anonymous cards issued in third countries, the regulation will likely force a consolidation of the market.

For the mainstream, self-custodial sector, the August 2026 incident serves as a stark reminder of the "upgrade authority" risk. In the world of smart contracts, the code is only as secure as the key that governs its updates. Even when a platform correctly implements decentralized custody, if the contract can be upgraded by a single private keypair, the platform remains effectively custodial.

The shift toward multisig governance—as evidenced by Rain’s move to a Squads multisig vault following the breach—is a necessary evolution. However, it does not mitigate the fundamental reliance on the issuer’s technical competency. As the industry matures, cardholders are increasingly forced to look past the marketing of "non-custodial" assets and interrogate the underlying infrastructure: who writes the code, who holds the upgrade keys, and what happens if the issuer’s corporate entity faces insolvency?

As of September 2026, the sector continues to grow, fueled by $250 million in venture capital and increasing institutional integration with traditional networks like Visa. Yet, the events of August confirm that in the crypto card space, the gap between a "non-custodial" promise and a "non-custodial" reality is often defined by a single line of smart contract code. Users who rely on these products are advised to treat their card balances not as long-term savings, but as transient funds for daily commerce, acknowledging that the ultimate safeguard remains the willingness of the issuer to step in when the code fails.

With $1.1 billion in monthly volume, the crypto card industry is no longer a niche experiment. It is a vital, if fragile, bridge between decentralized finance and global retail payments. Whether that bridge remains stable depends on the industry’s ability to transition from "trust-me" models toward transparent, audit-ready, and truly immutable infrastructure. Until then, the risks associated with program managers, shared contract pools, and opaque issuing partners will remain a defining characteristic of the landscape.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of precise, automated transactions that began siphoning funds from the card-balance accounts of Avici, a Solana-based neobank. By the time the incident concluded, 1,685 users had seen $500,859.22 vanish from their accounts. This event, while contained within a specific segment of the crypto-card market, exposed the underlying fragility of the "non-custodial" card model, a rapidly growing sector that has seen monthly transaction volumes surge to over $1.1 billion as of August 2026.

The breach was not a result of compromised private keys or stolen user wallets. Instead, it exploited a structural vulnerability within the smart contract architecture used by Rain, the card-issuing company that powers the back-end infrastructure for Avici and several other prominent self-custodial card programs. While Avici’s terms of service, last updated in June 2025, assured users that neither the company nor the issuer held custody of their collateral, the incident demonstrated that "non-custodial" is a term defined more by legal intent than technical impossibility.

The Anatomy of the August 28 Drain

The exploit followed a calculated timeline. The attacker’s address, 0xFVNFzq…, sat idle for 189 minutes after its initial funding before executing the first of 21,405 transactions. Of these, approximately 17,500 succeeded. The attack targeted a specific flaw in the Ed25519 signature-verification instruction within the Rain-controlled Solana program. By manipulating signature, key, and message offsets, the attacker bypassed a two-signature verification requirement, effectively granting themselves administrative rights over individual user collateral accounts.

Once the attacker achieved administrative status, they systematically initiated withdrawals. The median loss per user was roughly $24, though the largest individual losses exceeded $5,000. It is a critical distinction that the funds were not stolen from a centralized pot; rather, the "non-custodial" architecture relied on a single administrative authority—a plain signing key—which the attacker successfully spoofed.

Rain, the infrastructure provider, responded with significant speed, issuing a patch for the most severely affected program at 19:18:37 UTC, just seconds before the attacker ceased activity. While the company initially faced criticism for relying on outdated contract versions, it eventually moved the upgrade authority for its programs to a Squads multisig vault on September 5, 2026, adding a layer of security that was absent during the August breach.

The State of the Crypto-Card Market: A $1.1 Billion Ecosystem

According to data from Paymentscan, the crypto-card industry reached a new milestone in August 2026, processing $1.116 billion in volume across 11 million transactions. This growth represents a 32% increase since March 2026, even after accounting for restated figures that include previously untracked issuer flows.

However, the headline numbers obscure significant diversity in how these programs function. The market is effectively split into five distinct custody models, ranging from direct sales of assets to the operator (effectively creating an unsecured debt claim) to true self-custodial vaults where the operator lacks the power to move user funds.

The most controversial model, exemplified by KAST, involves the "sale" of virtual assets to the operator upon deposit. In this arrangement, the user’s balance is a ledger entry representing an enforceable debt claim against the company. Following a public feud with the CEO of Ether.fi, KAST amended its terms in July 2026 to clarify that deposited assets are owned by the company treasury, and users are essentially unsecured creditors in the event of insolvency. This model has drawn sharp criticism from industry peers who argue that such structures bypass the protective regulations governing traditional financial institutions.

Issuer Concentration and Infrastructure Risk

A significant portion of the self-custodial card market—including Avici, Tria, Payy, Solayer, Plasma One, and Ether.fi Cash—relies on a single issuer: Third National. Public filings and legal disclosures reveal that Third National is not a bank, but rather a Puerto Rico-licensed money transmitter operating under the Signify Holdings, Inc. umbrella.

This concentration of power is a double-edged sword. While it allows for rapid innovation and seamless integration with the Visa network, it creates a systemic "single point of failure." When a vulnerability is found in the underlying contract template, as happened in August, the contagion spreads instantly across multiple brands.

Despite the August incident, consumer confidence remains surprisingly resilient. The total value of stolen funds was fully refunded by the affected companies within 24 hours. Avici stated that the refunds were facilitated by Rain, signaling that the venture-backed infrastructure providers are prioritizing reputation and user retention over the strict legal liability definitions found in their terms of service.

The Regulatory Horizon: The End of Anonymous Spending?

As the industry matures, regulators are moving to close the loopholes that allowed for the proliferation of "no-KYC" (Know Your Customer) cards. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, set to apply from July 2027, will effectively prohibit anonymous crypto-asset accounts. This regulation will specifically target the practice of loading cards from anonymous crypto sources, likely forcing a massive consolidation in the market.

Many of the smaller, niche cards identified in recent directories are already facing existential threats. Services like Bit.Store have already seen their operations shuttered following regulatory actions against their underlying electronic money institutions (EMIs), such as the revocation of Paytend Europe UAB’s license in early 2026. These shutdowns serve as a stark reminder that when a regulatory body intervenes, the brand the consumer interacts with often has no power to recover or return assets.

Analyzing the "Non-Custodial" Promise

The core lesson of the August 2026 exploit is not that self-custody is fundamentally flawed, but that the industry’s marketing language is often divorced from technical reality. In the context of a cardholder agreement, "non-custodial" often refers only to the status of the funds during normal operation. It rarely accounts for who holds the upgrade keys, whether the code currently running is the same as the code that was audited, or what happens when a program manager—like Rain—must act as a lender of last resort to keep a project solvent.

The resilience of the market is evidenced by the rapid adoption of new, more transparent models. Programs like Gnosis Pay, which utilizes a modular architecture with specific roles and delays, or Ether.fi Cash, which publishes its contract addresses and relies on advanced multisig security, represent the next generation of crypto-native finance. These programs aim to minimize the need for "corporate backstops" by moving the responsibility for security back to the user and the code itself.

As the industry enters the final quarter of 2026, the focus is shifting from pure volume growth to structural integrity. The $1.1 billion in monthly volume is a testament to the utility of stablecoin-powered payments, but the August 28 incident proves that the infrastructure supporting these transactions remains an evolving target. For the end user, the path forward requires a closer look at the fine print: understanding whether their funds are held in a vault they control, or if they are simply a secondary claimant in a complex, privately managed settlement network.

Ultimately, the crypto-card market has proven that it can weather technical breaches through sheer financial force. However, as regulatory pressure mounts and the market continues to consolidate around a handful of large infrastructure providers, the definition of "non-custodial" will likely undergo a necessary, more rigorous evolution. The era of blind trust in "smart contract" marketing is coming to an end, replaced by a demand for verifiable, immutable, and truly decentralized control.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based digital wallet initiated a sequence of transactions that would expose a critical vulnerability in the architecture of modern "non-custodial" crypto debit cards. The wallet, which had been funded just three hours earlier with 1.79 SOL—purchased via approximately $190 in USDC bridged from the Ethereum network—began systematically draining card-balance accounts held by users of Avici, a Solana-focused neobank. By the time the incident was contained, 1,685 users had seen a combined total of $500,859.22 siphoned from their accounts. The breach did not target the users’ personal keys or primary wallets; instead, it exploited the specific smart contract infrastructure that allows these cards to function as "non-custodial" financial instruments.

The incident highlights a growing tension in the decentralized finance (DeFi) sector between the promise of user sovereignty and the technical realities of card-issuing infrastructure. While Avici’s terms of service, last updated on June 23, 2025, explicitly stated that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," the reality of the smart contract deployment told a different story. The contract in question belonged to Rain, a card-issuing entity that provides the backbone for a significant portion of the self-custodial card market. Despite the breach, Avici confirmed that Rain covered every refund in full, with Avici and Tria—a secondary program also affected by the same vulnerability—adding a 10% surplus to compensate users for the disruption.

Chronology of the August 28 Exploit

The exploit was characterized by a high degree of technical precision. The attacker’s wallet, identified by the address FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching the attack. Between 16:49:48 UTC and 19:18:52 UTC, the wallet executed over 21,400 transactions. Each successful hit followed a three-step process: a SubmitSignatures call utilizing native Ed25519 signature-verification, followed by an AddCollateralAdmin instruction, and finally a WithdrawCollateralAsset command.

The core of the vulnerability lay in the program’s signature-verification logic. The attacker’s second verification instruction redirected its signature, key, and message offsets back to the first, effectively allowing a single signature to satisfy a check intended to require two. This granted the attacker administrative privileges over more than 1,000 individual user accounts. Because the funds were held in a smart contract that the program manager—in this case, Rain—could theoretically upgrade with a single plain signing key, the "non-custodial" nature of the assets was undermined by centralized administrative authority.

Rain’s remediation was swift but highlighted the risks of legacy code. The first patch for the most heavily impacted program was implemented at 19:18:37 UTC, just 15 seconds before the attacker ceased activity. Subsequent patches for the other two programs were deployed shortly thereafter. By September 5, 2026, Rain had migrated the upgrade authority for these programs to a Squads multisig vault, a more secure arrangement that prevents any single key from unilaterally modifying the contract.

Market Context and Volume Growth

The incident occurred against a backdrop of rapid expansion for crypto-linked payment cards. According to data from Paymentscan, monthly crypto card volume reached $1.116 billion in August 2026, spanning 11 million transactions and over 287,000 active addresses. This figure represents the second consecutive month of volume exceeding the $1 billion threshold. Since March 2023, the cumulative volume for this sector has reached $11.61 billion.

However, the headline figures require careful interpretation. Paymentscan recently restated its historical data to include ten additional programs and unattributed issuer flows. Notably, approximately 36% of the August volume is derived from self-reported data by RedotPay, which complicates independent verification. When excluding these self-reported figures, the total volume of on-chain observed spending stands at approximately $545 million, a 55% increase since March 2026. Ether.fi Cash currently stands as the largest program with fully transparent, on-chain visible purchases, accounting for $109.5 million in August volume.

Custody Models: A Spectrum of Risk

The diversity of custody models currently employed by the 18 programs reviewed reveals a wide spectrum of legal and technical risk. These models generally fall into five distinct categories:

1. Sale to the Operator: Some programs, such as KAST, utilize terms that frame the transfer of assets as a "sale" to the company. In this model, the user holds a USD-denominated debt claim against the issuer rather than an ownership interest in the original crypto assets.
2. Custodial Nominee: Programs like RedotPay and Revolut act as custodians, holding assets on behalf of the user. While this is a standard financial arrangement, it introduces dependency on the custodian’s solvency.
3. Fiat Conversion: Exchange-based cards, such as those from Crypto.com and Kraken, convert crypto to fiat at the moment of the transaction. In these cases, no crypto balances are held on the card, and users are protected by established electronic money (e-money) regulations in jurisdictions like the EU and UK.
4. Program-Pool Smart Contracts: Programs like Avici, Tria, and Payy utilize smart contracts where collateral is held in the card program’s pool. As demonstrated in the August 28 incident, the vulnerability of this model is linked to the administrative authority over the contract, not the user’s individual wallet keys.
5. Self-Custodial Vaults: The strongest model, utilized by Gnosis Pay and Ether.fi Cash, involves smart contracts or vaults that the operator cannot move. These programs typically use scoped spend permissions or "delay modules" to ensure the user retains control, though even these systems are subject to potential signature-verification flaws.

The Role of "Third National" and Infrastructure Concentration

A critical finding in the investigation of these programs is the concentration of issuing services. Seven of the 18 programs reviewed—including KAST, Avici, Ether.fi, and Solayer—name "Third National" as their card issuer. Legal disclosures reveal that Third National is a business name for Nimbus LLC, an affiliate within the Signify Holdings (Rain) group.

This structure means that a substantial share of the "non-custodial" card market relies on a Puerto Rico-based money transmitter rather than a traditional chartered bank. Rain’s operational model involves borrowing stablecoins to facilitate network settlement for credit card receivables, effectively turning these "non-custodial" cards into charge cards financed by the issuer. While this model has allowed for rapid scaling—evidenced by Rain’s recent $250 million Series C funding round—it creates a single point of failure for the programs that rely on its codebase.

Implications for the Future of Crypto Payments

The events of August 2026 serve as a stark reminder that in the world of crypto-native finance, marketing terminology often diverges from technical reality. The term "non-custodial" in a cardholder agreement describes who cannot move funds during normal operation, but it remains silent on the critical issues of who wrote the smart contract, whether the deployed code matches the audited version, and who holds the administrative upgrade keys.

The rapid recovery of funds for affected users was made possible not by the robustness of the underlying code, but by the financial reserves of a private venture-backed entity. This provides a temporary safety net, but it does not resolve the systemic risks inherent in centralized administration of "decentralized" products. As the EU prepares to implement the Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) in 2027, the regulatory landscape for anonymous or "no-KYC" cards is expected to tighten significantly. These regulations will likely prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions.

For the end user, the path forward requires a higher degree of due diligence. Beyond the marketing slogans, participants must evaluate the specific custody model, the legal identity of the card issuer, the provisions regarding insolvency, and the security of the smart contract upgrade path. The August incident was a loud failure that necessitated a high-profile response, but as the broader industry matures, the quiet failures—such as the wind-downs of Kulipa and Gnosis Pay’s consumer interface—suggest that the market is beginning to prioritize sustainable, transparent infrastructure over rapid, experimental growth. The $1.1 billion monthly volume confirms the utility of crypto-linked cards, but the technical vulnerabilities exposed this summer emphasize that the bridge between traditional finance and blockchain remains under construction.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in bridged USDC—began a systematic extraction of funds from card-balance accounts managed by Avici, a prominent Solana-based neobank. This event, which lasted roughly two and a half hours, served as a stark reminder of the underlying vulnerabilities within the rapidly expanding "non-custodial" crypto debit card sector. By the time the final transaction occurred at 19:18:52 UTC, 1,685 users had seen a combined $500,859.22 vanish from a smart contract infrastructure shared by several programs, including Avici and Tria.

The incident was not a result of compromised user keys or illicit wallet access. Rather, the vulnerability resided in the very architecture that proponents often cite as the hallmark of safety: a specialized smart contract designed for card collateral. These contracts, while ostensibly user-controlled, are frequently subject to administrative upgrade paths that rely on single signing keys. This centralized control, combined with a signature-verification flaw, allowed the attacker to grant themselves administrative privileges over individual user accounts, effectively bypassing the security models that users believed were protecting their assets.

The Chronology of the August 28 Exploit

The precision of the attack suggests a sophisticated understanding of the target’s technical debt. The attacker’s wallet, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, performed 21,405 transactions during the exploit window, with 17,500 succeeding. Each success followed a three-step sequence against a Rain-controlled Solana program: an initial SubmitSignatures call utilizing a native Ed25519 signature-verification instruction, followed by an AddCollateralAdmin call, and concluding with a WithdrawCollateralAsset command.

The critical failure involved a faulty verification instruction that directed signature and message offsets back at the initial call, allowing a single signature to satisfy a two-signature requirement. This oversight effectively turned the attacker into a "collateral admin" for thousands of accounts. By 19:03:18 UTC, while the exploit was ongoing, the attacker initiated a deBridge order to move over 1 million USDC from Solana to Ethereum, which was subsequently funneled through Tornado Cash in standard mixing increments.

Rain, the card-issuing infrastructure provider behind these programs, responded by patching the affected Solana programs between 19:18 UTC and 19:43 UTC. On September 5, 2026, Rain transitioned the upgrade authority for these programs to a Squads multisig vault, a critical security improvement that was not publicly announced but was verified via on-chain analysis on September 10.

The Scale of the Crypto Card Market

Data from Paymentscan indicates that the crypto card market has entered a period of hyper-growth, with August 2026 volume reaching $1.116 billion across 11 million transactions. This represents a significant shift from the $153 million recorded in December 2024. While these figures reflect a maturing industry, they also mask significant complexities regarding how funds are actually held.

Paymentscan identifies five distinct custody models, ranging from "Sold to the Operator"—where the user holds only a debt claim against the issuer—to "Your Own Vault," where funds remain in a self-custodial smart contract debited only at the moment of authorization. The industry remains highly concentrated; Rain alone facilitates settlement for roughly 42% of the market’s total volume. When combined with RedotPay’s self-reported figures, just two entities account for approximately 78% of the total tracked volume. This concentration creates a systemic risk profile where a single technical failure in a shared codebase can affect dozens of seemingly disparate brands simultaneously.

The Myth of Non-Custodial Security

The term "non-custodial" has become a marketing imperative in the crypto card space, yet its legal and technical definitions vary wildly. Avici’s terms of service, last updated in June 2025, assured users that the company would never hold custody of collateral. While legally accurate, this statement provided little comfort to the 1,685 users whose funds were drained due to a flaw in the underlying Rain-managed contract.

This gap between marketing and mechanism is exemplified by programs like Solayer, which markets its Emerald card as "fully on-chain" while its internal security documentation reveals the use of offline, multisig-protected cold storage. This is, by definition, a custodial arrangement. The industry’s reliance on "Third National"—a Puerto Rican money transmitter and Rain affiliate—as an issuer for seven major programs further highlights the distance between the "DeFi" ethos and the reality of traditional financial infrastructure. These cards are effectively charge cards financed by borrowed stablecoins, not the seamless, on-chain experiences often depicted in promotional materials.

Regulatory and Institutional Implications

The regulatory landscape is set to undergo a fundamental shift with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) in July 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions. For the "no-KYC" card sector, this presents an existential threat. Currently, these services exploit the gap between "Know Your Business" (KYB) verification for the issuer and the lack of individual KYC for the cardholder.

Recent infrastructure failures—such as the collapse of the Kulipa program in July 2026, which abruptly ended services for Ready, Argent, and Solflare—demonstrate that the primary risk to users is often not a hack, but rather the fragility of the underlying business relationships. When issuers like Paytend have their licenses revoked or programs like Fiat24 pause operations to address compliance gaps, the brand the consumer interacts with is often left powerless to assist.

Official Responses and Remediation

The response to the August 28 exploit was swift, if opaque. Avici and Tria, recognizing the reputational damage at stake, opted to cover the losses out of their own balance sheets, with Avici explicitly stating that Rain funded the refunds. The total impact, approximately $1.1 million, was mitigated for the end-user within 24 hours. However, the incident highlighted a dangerous lack of transparency regarding pre-deployment audits. While Rain claims to use Sherlock for audits, the drained contracts were older versions that remained live—a classic "legacy code" vulnerability that audit-at-deployment models fail to address.

Ether.fi Cash remains a notable outlier in the category. By utilizing a public, address-verified vault on Optimism and maintaining clear documentation on its CashModule contract, it offers a level of transparency that is currently the exception, not the rule. The contrast between Ether.fi’s architecture and the shared, opaque collateral pools of other programs is a lesson in the importance of technical due diligence over marketing claims.

Moving Forward: What Users Should Analyze

For the end-user, the August 2026 events suggest five critical questions that must be addressed before depositing funds into any crypto-linked card:

1. Custody Classification: Does the contract transfer ownership to the operator, or is it a true self-custodial vault?
2. Issuer Identity: Is the issuer a chartered bank, an EMI, or an offshore money transmitter? If the issuer is not clearly named, the program should be viewed as high-risk.
3. Insolvency Protection: What happens if the service provider goes bankrupt? If the terms do not explicitly address the status of user funds in an insolvency event, users should assume they are unsecured creditors.
4. Upgrade Authority: Who holds the keys to upgrade the contract? If a single private key controls the contract, the "non-custodial" nature of the product is largely performative.
5. Transparency of Metrics: Are volume and spend metrics verifiable on-chain, or are they self-reported numbers that lack independent oversight?

The rapid expansion of the crypto card market in 2026 has provided users with unprecedented convenience, but it has also introduced a level of technical and systemic risk that the current marketing landscape fails to articulate. While the August 28 exploit ended with users being made whole, the next failure may not be supported by a $338 million venture-backed balance sheet. As the industry approaches the 2027 regulatory deadline, the divergence between robust, transparent platforms and those relying on "nuanced loopholes" will likely accelerate, forcing a consolidation that favors transparency and structural integrity over the current proliferation of proprietary, black-box solutions.

The reliance on a single company to manage nearly half of the market’s settlement volume creates a "too-big-to-fail" scenario that contradicts the decentralization tenets of the blockchain ecosystem. Ultimately, the stability of the crypto card market in the coming years will depend less on the cleverness of its smart contract marketing and more on the regulatory and technical rigor of the institutions standing behind the cards. Until that time, the user is left to navigate a landscape where "non-custodial" is a description of the current state of a contract, rather than a guarantee of future security.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based wallet—funded just three hours prior with 1.79 SOL via a bridge from Ethereum—executed the first of over 21,000 transactions that would systematically drain thousands of user accounts belonging to Avici, a prominent Solana-focused neobank. By the time the incident concluded, 1,685 users had seen their balances liquidated, totaling $500,859.22 in losses. This breach was not a result of compromised private keys or standard phishing; rather, it exploited a critical vulnerability in a shared smart contract architecture used by Avici and several other programs within the burgeoning self-custodial crypto card market.

The incident highlights a growing tension in the financial technology sector: the gap between the marketing promise of "non-custodial" finance and the technical reality of how these assets are governed. While Avici’s terms of service explicitly stated that the company would not hold custody of user collateral, the underlying smart contract infrastructure—managed by the card-issuing company Rain—contained an authorization flaw that allowed an attacker to bypass security checks. This event has forced a broader audit of the $1.1 billion monthly crypto card industry, raising questions about transparency, issuer reliance, and the legal status of digital assets in the event of platform failure.

The Anatomy of the August 28 Breach

The attack vector was surgically precise. The perpetrator’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, targeted a vulnerability in the signature-verification instruction of a Rain-controlled Solana program. By manipulating signature and message offsets, the attacker effectively tricked the program into accepting a single signature as the required dual-authorization for administrative actions. Once the attacker granted themselves "Collateral Admin" status, they were able to initiate asset withdrawals from individual user accounts.

The chronology of the event reveals the speed at which modern on-chain exploits unfold. The initial exploit began at 16:49:48 UTC, and the final malicious transaction was recorded at 19:18:52 UTC. In the interim, the attacker managed to successfully process approximately 17,500 transactions. By 19:03:18 UTC, while the drain was still in progress, the attacker initiated a series of deBridge orders to move approximately 1.1 million USDC from the Solana network to Ethereum. These funds were subsequently funneled into Tornado Cash in a standard "laddered" withdrawal pattern, effectively obscuring the trail of the stolen capital.

Rain’s response was rapid but highlighted the centralized nature of what is often marketed as decentralized infrastructure. The company patched the affected Solana programs between 19:18 and 19:43 UTC, mere minutes after the drain concluded. Following the patch, Rain and the affected programs, including Avici and Tria, committed to full refunds. While this prevented a public relations catastrophe, it underscored a reality that the industry rarely discusses: the "non-custodial" cardholder was ultimately saved by the corporate balance sheet of a venture-backed firm, not by the inherent security of the blockchain itself.

The State of the Crypto Card Market: $1.1 Billion and Counting

According to data from Paymentscan, the crypto card industry has seen explosive growth. As of August 2026, monthly transaction volume hit $1.116 billion across 11 million individual transactions and nearly 290,000 active addresses. This marks the second consecutive month that the sector has exceeded the billion-dollar milestone, following a steady climb from $153 million in December 2024.

However, these figures carry significant caveats. A substantial portion of this volume—nearly 42%—is routed through Rain, which acts as the infrastructure provider for numerous smaller programs. Furthermore, the reliance on self-reported data from major players like RedotPay makes it difficult to ascertain the true level of risk within the ecosystem. When adjusting for on-chain verifiable spend, the actual figures are closer to $545 million, representing a 55% increase since March 2026. This discrepancy highlights the lack of standardized reporting in the crypto payments space, where market share is often conflated with user activity.

The Custody Spectrum: Five Models of Risk

To understand why some cards were vulnerable while others remained secure, one must look at the legal and technical "custody models" currently in operation. The industry generally falls into five distinct categories, ranging from total loss of ownership to true self-custody.

1. Sold to the Operator: In this model, such as that employed by KAST, the user’s deposit is legally considered a sale of assets. The user no longer owns the cryptocurrency but instead holds a debt claim against the platform. In the event of a bankruptcy, these users are merely unsecured creditors.
2. Held in Custody: Platforms like RedotPay and Revolut act as custodians. While they claim to hold assets for the user, these assets are often subject to general liens and may be reachable by the platform’s creditors during insolvency proceedings.
3. Fiat Conversion: Exchange-based cards, such as those from Crypto.com or Kraken, often do not hold crypto on the card at all. Assets are converted to fiat at the moment of the transaction, and the fiat is held in regulated bank accounts. While this offers the most protection, it is dependent on the regulatory status of the bank, not the security of the blockchain.
4. Program-Managed Smart Contracts: This was the model utilized by Avici and Tria. The collateral sits in a smart contract. While the user technically owns the assets, the "upgrade authority"—the power to change the rules of the contract—is often held by the program manager (in this case, Rain). The August breach occurred because this authority was centralized, not distributed.
5. Direct Authorization Vaults: Gnosis Pay and Ether.fi Cash represent the most secure tier. Here, the user retains control over a smart contract (a "Safe") where funds remain until an authorization is explicitly signed. Even if the program manager fails, the user’s assets remain in their own vault, inaccessible to the provider.

The "Third National" Concentration Risk

A significant systemic risk identified in the 2026 data is the concentration of issuers. Seven major programs—KAST, Avici, Ether.fi, Plasma One, Solayer, Payy, and Tria—all name "Third National" as their card issuer. Investigations reveal that Third National is not a bank in the traditional sense, but a Puerto Rico-based money transmitter and a subsidiary of Signify Holdings (Rain).

This creates a "single point of failure" scenario. When an infrastructure provider like Rain faces a technical exploit, the impact is not isolated to one brand but ripples across the entire portfolio of programs that rely on their shared codebase. The August incident demonstrated that while the brands appear distinct to the consumer, they are fundamentally tethered to the same administrative keys and contract logic.

Regulatory Horizons and Future Implications

The industry is currently facing a dual challenge: increasing regulatory scrutiny and the natural consolidation of infrastructure. With the European Union’s Anti-Money Laundering Regulation (EU 2024/1624) set to take full effect in July 2027, the era of anonymous, no-KYC crypto cards is nearing an end. The new rules effectively ban anonymous prepaid cards loaded with crypto, forcing providers to either implement rigorous identity verification or face exclusion from EU merchant terminals.

For the self-custodial sector, the lessons of August 2026 are clear. "Non-custodial" is a marketing term that fails to describe the reality of governance. The security of a card program is not merely about whether the user holds their private keys, but about who holds the upgrade keys to the smart contracts, whether those contracts have been audited for the specific version currently in production, and how the program is financed.

As the industry matures, the survivors will likely be those who can provide the highest degree of technical transparency. Ether.fi and Gnosis Pay have set a new standard by publishing contract addresses and governance modules, allowing users to verify for themselves where their money sits. In contrast, programs that hide behind opaque "licensed partners" and "proprietary infrastructure" remain inherently vulnerable.

Ultimately, the August exploit serves as a stark reminder that while the blockchain provides a ledger of truth, the surrounding financial infrastructure—the bridges, the issuers, and the administrative authorities—is only as robust as its weakest line of code. For the 1,685 users who were made whole, the experience was a fortunate reprieve. For the industry, it is a definitive call to move away from centralized "non-custodial" templates toward architectures that truly prioritize user sovereignty over administrative convenience.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began systematically draining card-balance accounts held by users of Avici, a prominent Solana-based neobank. By the time the exploit was neutralized, 1,685 users had seen their balances liquidated, totaling a loss of $500,859.22. This incident, while rapidly contained, has cast a harsh spotlight on the "non-custodial" crypto card market, a sector that has seen its monthly transaction volume explode to over $1.1 billion as of August 2026.

The vulnerability did not stem from stolen private keys or compromised user devices. Instead, it lay within a specific Solana card contract shared by Avici and several other programs. The underlying infrastructure belongs to Rain, a card-issuing company that has become the backbone of much of the self-custodial card market. While Avici’s terms of service, last updated in June 2025, assured users that neither the company nor the issuer held custody of their collateral, the technical reality of the smart contract architecture allowed for a systemic failure. The incident serves as a stark reminder that in the world of crypto-native finance, the definition of "non-custodial" is often dictated by the nuance of smart contract permissions rather than the absolute security of user assets.

A Chronology of the August Drain

The exploit was surgical and efficient. The attacker’s wallet, identified on-chain as 0xFVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching its first attack at 16:49:48 UTC. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 successfully interacting with the Rain-controlled Solana program.

The mechanics of the exploit relied on an authorization bug within the SubmitSignatures call. By manipulating the signature-verification instruction—pointing the signature, key, and message offsets back at one another—the attacker managed to satisfy a two-signature check with only a single signature. This granted the attacker administrative status over individual user collateral accounts, allowing for the immediate withdrawal of funds.

The fallout was swift. Between 19:03 and 19:49 UTC, as the drain was concluding, the stolen funds were bridged from Solana to Ethereum and moved through Tornado Cash. By 19:18 UTC, Rain had begun patching the affected programs. By September 5, all upgrade authorities for the involved contracts were successfully migrated to a Squads multisig vault, providing a long-term fix to the security architecture.

Market Growth and Concentration Risks

According to data from Paymentscan, the crypto card market has witnessed extraordinary growth, rising from $153 million in monthly volume in December 2024 to $1.116 billion by August 2026. This trajectory highlights a significant shift in consumer behavior, as users increasingly seek to bridge the gap between volatile digital assets and daily retail spending.

However, this growth is heavily concentrated. Paymentscan’s issuer mapping attributes approximately 42% of August’s total volume—$468 million—to programs settling through Rain. When combined with the self-reported figures from RedotPay, these two entities facilitate roughly 78% of the entire tracked crypto card market. This concentration presents a systemic risk: while the August exploit was limited to specific Solana contracts, the reliance on a narrow set of infrastructure providers means that a single architectural flaw can ripple across multiple independent brands simultaneously.

Decoding Custody Models

The industry’s terminology often obscures the legal reality of where money resides. An analysis of 18 major crypto card programs reveals five distinct custody models, ranging from direct debt claims to fully on-chain vaults:

1. Sale-to-Operator: Programs like KAST have adopted language that characterizes user deposits as a "sale" of assets to the company. In this model, the user holds a USD-denominated debt claim against the operator, often with limited liability protections and no guarantee of asset segregation in the event of bankruptcy.
2. Nominee Custody: Platforms like Revolut act as a "nominee" for the user. While the platform holds legal title, the user is defined as the beneficial owner. This model relies on the robustness of the platform’s balance sheet and the clarity of its insolvency procedures.
3. Fiat-Only Issuers: Many exchange-based cards, such as those from Crypto.com or Kraken, do not hold crypto assets on the card account at all. Crypto is held in exchange custody and converted to fiat only at the moment of a transaction. In the EU, this is governed by strict e-money safeguarding regulations.
4. Shared Program Pools: This is the category that suffered the August exploit. In this model, user collateral is held in a smart contract. While the user technically owns the collateral, the contract is managed by an operator with administrative upgrade keys. If the authorization logic is flawed, the "non-custodial" nature of the account provides no protection.
5. Self-Custodial Vaults: Programs like Gnosis Pay and Ether.fi Cash utilize sophisticated smart account architectures (such as Safe) where the user maintains control over their assets, often utilizing modules for spend permissions or time-delayed transactions. These are currently the most robust designs, though they are not immune to logic errors.

The Issuer Landscape: Beyond Traditional Banking

A significant finding in the current market structure is the role of "Third National." Seven of the programs analyzed—including Avici, KAST, and Ether.fi Cash—list Third National as their card issuer. Investigations reveal that Third National is not a chartered bank, but rather a Puerto Rico-based money transmitter operating under the corporate umbrella of Signify Holdings, Inc. (Rain).

This underscores a broader trend: many crypto-native card programs are built on non-bank infrastructure, utilizing stablecoin lending networks to facilitate settlement. When a user taps their card, Rain settles with the merchant via Visa and is subsequently repaid from the user’s collateral contract. This "charge card" model, financed by institutional stablecoin liquidity, is highly scalable but introduces dependencies on the creditworthiness and operational security of the underlying infrastructure provider.

The Regulatory Horizon and Future Outlook

The regulatory landscape is poised to change dramatically with the implementation of the EU’s Anti-Money Laundering Regulation (Regulation (EU) 2024/1624), effective July 2027. This framework will effectively prohibit anonymous crypto-asset accounts and limit the usage of anonymous prepaid cards. These impending rules are expected to force a consolidation in the market, favoring programs that maintain transparent KYC (Know Your Customer) and KYB (Know Your Business) compliance.

The recent failures of programs like Kulipa and the closure of Bit.Store following the revocation of its issuer’s license serve as reminders that card programs are fragile. Often, the decision to terminate a service is made by a sponsor bank or a network, leaving the consumer brand with little recourse.

Lessons from the August Incident

Despite the loss of $500,000, the August 28 incident had a relatively positive outcome for users. Rain and the affected programs, such as Avici and Tria, stepped in to refund all impacted users within 24 hours. This response highlights that, for now, the industry is operating on a model of "socialized risk," where venture-backed entities prioritize reputation and customer retention by covering losses out of their own balance sheets.

However, the event serves as a warning for the next phase of market development. As transaction volumes continue to grow, the industry can no longer rely on the promise of venture-backed refunds to mitigate smart contract risks. The path forward requires a transition toward more transparent, immutable, and fully audited on-chain vault architectures. For the end user, the lesson is clear: "non-custodial" is not a synonym for "invulnerable." Before topping up a card, users should look past the marketing, verify the issuer’s regulatory standing, and understand whether the smart contract holding their collateral is truly isolated or subject to the administrative whims of a single, centralized key.

As of September 2026, the sector stands at a crossroads. The integration of stablecoin-powered payments into the Visa network is a major technological milestone, but the infrastructure supporting this growth remains a work in progress. For the millions of users participating in this ecosystem, the security of their assets depends as much on the quality of the legal documentation and the strength of the multisig upgrade keys as it does on the underlying blockchain technology.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began draining balances from users of Avici, a prominent Solana-based neobank. While Avici’s legal documentation, last updated on June 23, 2025, explicitly stated that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," this contractual language failed to protect the underlying assets. By the time the incident was resolved, 1,685 users had seen their accounts compromised, resulting in a collective loss of $500,859.22. The funds were siphoned from a smart contract architecture utilized not only by Avici but by several other programs, all of which relied on infrastructure provided by Rain, the dominant firm in the self-custodial card market.

The breach was not a traditional theft of private keys, nor was it a compromise of individual user wallets. Instead, the vulnerability lay within the central "program manager" contract—a mechanism designed to be non-custodial but which nonetheless contained a single, plain signing key capable of upgrading the contract’s logic. This event has cast a spotlight on the fragility of the "non-custodial" card category, which has seen transaction volumes nearly double since the spring of 2026, even as the industry grapples with the collapse of large issuers and the revocation of electronic money institution (EMI) licenses.

Chronology of the August 28 Exploit

The attacker’s wallet, identified on-chain as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained largely inactive for nearly three hours following its funding. At 16:49:48 UTC, the first exploit transaction was broadcast. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with roughly 17,500 resulting in successful fund transfers.

The exploit utilized a sophisticated authorization bug in the Rain-controlled Solana programs. By leveraging a native Ed25519 signature-verification instruction, the attacker forced the program to accept a single signature as valid for a two-signature requirement. This allowed the attacker to grant themselves "collateral admin" privileges on over 1,000 individual user accounts. Once administrative control was established, the withdrawal of funds became a trivial matter. The median loss per user was approximately $24, though some accounts saw significantly higher depletion, with the largest individual loss reaching $5,268.

The incident response was rapid but largely private. By 19:18:37 UTC, just fifteen seconds before the attacker’s final malicious transaction, Rain had pushed a patch to the most severely affected program. The remaining programs were updated by 19:43:42 UTC. By September 5, Rain had migrated the upgrade authority for all three compromised programs to a more secure Squads multisig vault (7MoSDo66QknjsyE8yX9VnsrbGj4cQTDYVjo2JHLt5RSL), finally closing the door on the vulnerability.

The Landscape of Crypto Card Volume

According to data from Paymentscan, total crypto card volume in August 2026 reached $1.116 billion, spanning 11 million transactions and over 287,000 active addresses. This marks the second consecutive month that volume has exceeded the $1 billion threshold. Since March 2023, cumulative volume in this sector has surpassed $11.6 billion, reflecting a 32% growth rate since March 2026 when adjusted for restated figures and improved data tracking.

However, these figures carry significant caveats. A large portion of this volume is "self-reported" by operators rather than verified on-chain. For instance, RedotPay—the largest card program by volume—accounted for $403.6 million in August, or roughly 36% of the industry total. Because Paymentscan tracks top-ups on-chain but relies on internal company data for spend, the true nature of liquidity remains opaque. Programs such as Ether.fi Cash, which allow for full on-chain visibility of every purchase, provide a more transparent, albeit smaller, data set. Ether.fi Cash processed $109.5 million in August, crossing the milestone of 10 million total transactions.

Understanding Custody Models

The industry is currently divided into five distinct custody models, each with varying degrees of legal and technical risk.

1. Sold to the Operator: Programs like KAST have moved toward a "sale" model where the user’s crypto assets are legally transferred to the company in exchange for a USD-denominated debt claim. In the event of bankruptcy, users are treated as general creditors.
2. Held in Custody for You: This model, used by RedotPay and major exchanges like Coinbase, involves the operator holding assets on the user’s behalf. While legally distinct from the operator’s treasury, the enforceability of these claims in bankruptcy remains untested in many jurisdictions.
3. Converted to Fiat at Licensed Issuers: Companies like Crypto.com and Kraken convert crypto to fiat at the point of sale. In the EU and UK, these fiat funds are often "safeguarded" under e-money regulations, providing a layer of protection against institutional insolvency.
4. Smart Contract Pools: Programs like Avici and Tria allow users to maintain their own contracts, but these contracts are managed within a pool administered by a third party like Rain. This was the model compromised in August.
5. Direct Vault/JIT Debit: The most robust model, used by Gnosis Pay and Bridge, involves a self-custodial smart account that the operator cannot move. Spend permissions are strictly scoped, and the operator only pulls the exact amount required at the moment of authorization.

The "Third National" Concentration Risk

A significant systemic vulnerability is the high level of concentration in card issuing. Seven of the 18 programs analyzed—KAST, Avici, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria—name "Third National" as their issuer. Investigation reveals that Third National is not a bank in the traditional sense, but a brand name for Nimbus LLC, a Puerto Rico-licensed money transmitter and an affiliate of Rain.

Rain acts as the central hub, facilitating settlement through a network of capital partners who borrow stablecoins to cover card receivables. While this model allows for rapid scaling, it introduces a "single point of failure" for the infrastructure. If the issuer’s license is revoked or the network mandates a shutdown, multiple card programs could be rendered unusable simultaneously.

Implications and Regulatory Outlook

The August 28 exploit demonstrated that "non-custodial" marketing often masks the reality of centralized control over smart contract upgrade keys. While Avici and Rain successfully made all affected users whole, the recovery was funded by the companies’ own balance sheets, not by any inherent feature of the underlying protocol.

The industry is also bracing for the implementation of the EU’s Anti-Money Laundering Regulation (AMLR) in 2027. This regulation will effectively prohibit anonymous crypto-asset accounts and restrict the use of anonymous prepaid cards. As supervisors tighten their grip, the era of "no-KYC" cards appears to be reaching its end. Many of these services have already faced sudden shutdowns or BIN freezes as regulators and card networks prioritize compliance over the privacy features previously marketed to users.

Conclusion

The incident highlights a critical distinction between technical self-custody and legal protection. Even if a user retains their private keys, the smart contract governing their card spend may still be susceptible to administrative interference or design flaws. As the crypto card market continues to scale—now handling over $1 billion monthly—users must look beyond marketing buzzwords. They must scrutinize who holds the upgrade authority for their contracts, who the legal issuer is, and what happens to their assets in the event of an institutional insolvency.

For now, the sector remains in a state of rapid, often chaotic, evolution. The success of programs like Ether.fi Cash and Gnosis Pay suggests a path toward more secure, transparent architectures, but the concentration of risk within Rain-led programs indicates that systemic vulnerabilities remain a central concern for the next phase of the industry’s growth. The lesson from August 2026 is clear: in the world of crypto-native finance, where the money sits and who controls the code matters far more than the promise of being "non-custodial."