Smart Contracts

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from the Ethereum network—initiated a systematic drainage of card-balance accounts associated with Avici, a prominent Solana-based neobank. While Avici’s terms of service, last updated in June 2025, explicitly stated that neither the platform nor the issuer held custody of user collateral, the technical reality of the infrastructure proved far more vulnerable than the legal disclaimers suggested. Within hours, the incident confirmed the fears of many security researchers: even in "non-custodial" arrangements, the code managing the funds often remains under the unilateral control of the program manager.

By the time the breach was contained, Avici’s internal reconciliation revealed that 1,685 users had lost a collective $500,859.22. The vulnerability resided not in the users’ private wallets, but in a shared "Solana card contract" utilized by Avici and several other programs within the ecosystem. The infrastructure, provided by the card-issuing firm Rain, acted as the backbone for a significant portion of the self-custodial card market. While Avici and the secondary program Tria, which was also impacted, managed to cover all losses with an additional 10% premium, the incident exposed systemic risks that extend far beyond a single bank.

A Chronology of the August 28 Exploit

The breach was a masterclass in precision and speed. The attacker’s wallet, identified as 0xFVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding. Once the attack commenced, it executed roughly 21,405 transactions, of which 17,500 were successful, over a window of approximately 150 minutes. The mechanism involved a signature-verification flaw in the native Ed25519 instructions within Rain’s Solana program. By manipulating signature and key offsets, the attacker bypassed the requirement for two-party authorization, effectively granting themselves administrative access to individual user collateral accounts.

The attacker moved rapidly to launder the stolen assets. Between 19:03 and 19:49 UTC, the funds were bridged back to Ethereum and channeled through Tornado Cash in a standard laddered deposit pattern. By the time Rain patched the vulnerability at 19:18 UTC for the most severely affected program, the majority of the liquid capital had already been obfuscated. Rain later transitioned its upgrade authority to a secure Squads multisig vault on September 5, a critical security upgrade that should have been in place long before the breach occurred.

The Landscape of Crypto Card Custody

To understand the scope of this failure, one must categorize the five distinct models currently dominating the $1.1 billion-per-month crypto card industry. As of September 2026, Paymentscan data indicates that volume has surged from $153 million in late 2024 to over $1.1 billion, with 287,640 active addresses engaged in monthly transactions.

1. Sale to Operator: Models like KAST treat user deposits as a sale of assets, converting crypto into a USD-denominated debt claim. In this model, the user is an unsecured creditor, and their claim is often capped, leaving them with little recourse in the event of bankruptcy.
2. Custodial Nominee: Platforms like RedotPay and Revolut hold assets in a "nominee" capacity. While they claim to hold legal title on behalf of the user, the funds are legally commingled within the platform’s broader corporate treasury or omnibus accounts.
3. Fiat Conversion: Exchange-based cards from providers like Crypto.com or Kraken do not hold crypto on the card at all. Instead, they facilitate a just-in-time conversion to fiat currency, which is held by a licensed banking partner. In the EU, these funds are subject to "safeguarding" requirements, which offer a statutory layer of protection against insolvency.
4. Program-Managed Smart Contracts: This is the category occupied by Avici and Tria. Here, users fund a smart contract, but the program manager (Rain) retains the authority to upgrade that contract. The failure of August 28 proved that this "non-custodial" label is effectively a marketing term rather than a technical guarantee of user control.
5. Vault-Based Self-Custody: The most secure model, utilized by Gnosis Pay and Ether.fi Cash, involves smart contracts where the user retains exclusive control via signing keys or hardware-isolated enclaves. In these models, the operator cannot move the funds, as the smart contract logic is immutable or governed by user-defined roles.

The Third National Problem

A recurring theme in the 2026 infrastructure audit is the reliance on "Third National." Seven major programs—KAST, Avici, Ether.fi, Plasma One, Solayer, Payy, and Tria—all identify Third National as their card issuer. However, Third National is not a bank. It is a subsidiary of Signify Holdings (Rain), licensed as a money transmitter in Puerto Rico.

This concentration creates a single point of failure. When Visa or the issuer decides to terminate a program, as seen previously with the closure of Bit.Store following the revocation of Paytend’s license, the brand that the customer interacts with has no power to intervene. The reliance on borrowed stablecoins to facilitate settlement adds another layer of financial complexity, as the card programs are essentially operating as high-velocity credit lines financed by capital partners.

The No-KYC Illusion

The "no-KYC" (Know Your Customer) card sector has been particularly volatile. A recent price list circulated in the community highlighted the high costs and hidden fees associated with these cards. However, the true risk lies in the regulatory arbitrage. As the EU’s Anti-Money Laundering Regulation (2024/1624) approaches full implementation in July 2027, the window for anonymous prepaid cards is rapidly closing.

Articles 19 and 79 of the new regulation will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing transactions from third-country anonymous cards. The implication is clear: the current generation of no-KYC cards, which rely on the gap between business-level verification and user-level anonymity, will likely face severe operational headwinds. The sudden shutdowns of Bit.Store and the instability of programs like SolCard are early warnings of a market that is increasingly incompatible with global financial standards.

Infrastructure Failures and Market Consolidation

The August exploit was the most visible failure, but it was not the only one. The industry saw a wave of quiet collapses in 2026. Kulipa, which raised $6.2 million in venture funding, halted operations in July, effectively ending the card programs for Ready and Solflare. Similarly, the acquisition of Cypher by Nium and the subsequent shutdown of Cypher’s platform terminated the Moonwell card.

Even Gnosis Pay, the gold standard for self-custodial card design, announced the winding down of its consumer-facing interface in September. While the underlying technology remains viable as a white-label solution, the consumer product failed to reach the scale necessary to remain independent.

Strategic Analysis: Implications for Users

The overarching lesson of the 2026 crypto card landscape is that the terminology used in legal agreements is rarely indicative of the technical risk. A card described as "non-custodial" may still be subject to the whims of an administrator who holds the upgrade keys.

For users, the priority must shift from trusting marketing materials to verifying technical architecture. Essential due diligence now includes:

• Verifying the Issuer: If the issuer is a money transmitter rather than a regulated bank, the program is inherently more fragile.
• Audit Transparency: Does the company publish the addresses of its smart contracts? If the documentation is behind a login or entirely absent, the user is operating on faith.
• Insolvency Clauses: Does the contract explicitly state how funds are handled if the company fails? If it does not, the user should assume the funds are at risk.
• Upgrade Authority: Who holds the keys to the smart contract? If the operator can upgrade the contract unilaterally, the "non-custodial" label is a misnomer.

As of September 10, 2026, the industry continues to grow, with major players like MoneyGram and Western Union launching stablecoin-backed programs. However, the August incident serves as a stark reminder that scale does not equal security. The rapid refunding of Avici users by Rain was a fortunate outcome for those involved, but it was a result of corporate policy, not a inherent feature of the underlying financial technology. Investors and users alike should recognize that in the current market, the distance between a successful transaction and a total loss of funds is often just a single line of vulnerable code.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based digital wallet—funded only three hours earlier with 1.79 SOL purchased via a modest $190 USDC bridge—initiated a sophisticated, programmatic drain of user card-balance accounts held by Avici, a prominent Solana-based neobank. By the time the exploit concluded, 1,685 users had seen a combined $500,859.22 siphoned from their accounts. This event, while contained, sent shockwaves through the rapidly expanding $1.1 billion-a-month crypto debit card sector, exposing significant vulnerabilities in the architecture of "non-custodial" financial products.

The incident targeted a specific smart contract architecture used by Avici and several other programs, all of which relied on infrastructure provided by Rain, a dominant player in the self-custodial card market. While Avici’s terms of service, last updated in June 2025, explicitly stated that neither Avici nor its issuer held custody of client collateral, the reality of the technical implementation proved more precarious. The funds were held in a smart contract that, while ostensibly user-controlled, remained susceptible to administrative upgrades and logic flaws that bypassed the users’ own keys.

A Chronology of the August 28 Exploit

The breach was not a result of compromised user private keys or a phishing attack on individual customers. Instead, it was a precise authorization exploit. Investigation of on-chain data shows the attacker’s wallet (FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj) executed 21,405 transactions within a window of approximately two and a half hours, with roughly 17,500 succeeding.

The attacker utilized a vulnerability in the signature-verification logic of the Rain-controlled Solana program. By manipulating the Ed25519 signature-verification instruction, the attacker successfully tricked the contract into accepting a single signature as the two required approvals for administrative actions. This effectively granted the attacker administrative control over over a thousand individual collateral accounts. Once elevated to "collateral admin" status, the attacker systematically invoked the WithdrawCollateralAsset function.

The financial impact was swift. The attacker converted the stolen assets into approximately 1.11 million USDC, which was then bridged to Ethereum and funneled through Tornado Cash in a standard laundering sequence. The entire operation was completed within hours, leaving the victims with no recourse through traditional banking channels.

The Response and Remediation

Despite the severity of the loss, the immediate aftermath was marked by a swift, albeit private, recovery effort. Avici reported that all 1,685 affected users were made whole within 24 hours. The capital for these refunds was provided by Rain, the underlying infrastructure provider, which also facilitated a 10% bonus for affected Avici and Tria users as a gesture of good faith.

Rain moved quickly to patch the vulnerability. By 19:18 UTC, mere minutes after the final malicious transaction, the first patch was deployed. By September 5, Rain had successfully migrated the upgrade authority for all affected programs to a Squads multisig vault, adding a layer of multi-party security that had been absent at the time of the hack. However, the lack of a public post-mortem remains a point of contention for security researchers and industry observers, who argue that such transparency is essential for maintaining trust in the "non-custodial" label.

The Ecosystem: Custody and Risk

The August breach highlights a critical misconception regarding the term "non-custodial." In the context of 2026 crypto cards, the term describes who cannot move funds under normal conditions, but it often obscures who holds the "upgrade keys" to the underlying smart contracts.

The industry currently operates under five distinct custody models, each carrying unique risk profiles:

1. Sold to the Operator: Assets are effectively sold to the provider in exchange for a debt claim. KAST is the most prominent example, where users hold an enforceable claim against the operator’s treasury, placing them behind senior debt in the event of bankruptcy.
2. Nominee Custody: Platforms like Revolut hold legal title on behalf of the user. While this offers some regulatory protection, it remains a centralized model.
3. Fiat Conversion: Exchanges like Crypto.com and Kraken convert crypto to fiat at the moment of the swipe. The crypto remains in exchange custody, while the fiat is held by licensed banking partners, subject to e-money safeguarding regulations.
4. Program-Managed Contracts: This is the category Avici, Tria, and Rain occupied. Users "own" their collateral in a smart contract, but the program manager holds the administrative authority to upgrade that contract.
5. Direct Vault Access: Models like Gnosis Pay and Ether.fi Cash represent the highest level of security, where funds are held in user-controlled vaults that the operator cannot unilaterally move, even if they wanted to.

Market Concentration and Regulatory Concerns

The reliance on a single infrastructure provider—Rain—has become a structural reality of the crypto card market. Seven of the 18 programs analyzed, including KAST, Avici, Ether.fi, and Tria, name "Third National" as their card issuer. Third National is not a bank, but a Puerto Rico-licensed money transmitter and a subsidiary of the Rain group.

This concentration of power means that systemic risks are shared across a wide swath of the industry. While the August exploit was limited to specific Solana-based contracts, the fact that a single bug could impact multiple independent-seeming neobanks demonstrates a hidden fragility in the sector.

Furthermore, the "no-KYC" (Know Your Customer) card market remains a wild west of shifting regulatory standards. Many of these cards operate in a gray area, exploiting the gap between corporate entity verification and individual user verification. As EU Regulation (EU) 2024/1624 approaches its July 2027 implementation date, the window for these anonymous, crypto-loaded cards is rapidly closing. The new regulations will effectively outlaw anonymous reloadable cards and place significant pressure on offshore issuers, likely forcing a wave of consolidation and shutdowns.

Broader Implications for the Industry

The failure of several high-profile programs in 2026—including the wind-down of Kulipa’s infrastructure and the suspension of services by Fiat24—underscores that the primary risk to crypto cardholders is not always a hack, but the potential for sudden service termination. When an infrastructure provider or a licensed issuer decides to wind down, the "non-custodial" nature of these cards provides a safety net for assets, but it does not prevent the loss of the product itself.

The Gnosis Pay transition, which saw the shutdown of its consumer interface in favor of a white-label platform, suggests that the market is moving toward institutional-grade infrastructure. The consumer-facing layer is volatile, but the underlying primitives—smart contract-based spending and just-in-time fiat conversion—are becoming industry standards.

As of September 2026, the crypto card market has reached a critical maturity threshold. With $1.1 billion in monthly volume, it is no longer a niche curiosity. However, the August exploit serves as a stark reminder that "on-chain" does not automatically equate to "secure." The future of the industry depends not only on the performance of the cards but on the integrity of the smart contracts that hold the collateral and the transparency of the issuers who provide the gateway to the traditional financial system. For the average user, the lesson is clear: until the technical documentation is public and the upgrade authority is decentralized, the "non-custodial" card is only as secure as the company behind it.

At 16:49:48 UTC on Friday, August 28, 2026, a dormant Solana wallet—funded just three hours prior with 1.79 SOL—executed the first of over 21,000 transactions that would systematically drain thousands of user accounts linked to the Avici neobank. Within hours, 1,685 users discovered that $500,859.22 had vanished from their card-linked collateral accounts. While the incident was localized to specific Solana smart contracts, it sent a shockwave through the burgeoning $1.1 billion-a-month crypto card industry, exposing the hidden architectural risks of "non-custodial" financial products.

The exploit was not the result of a stolen private key or a compromised user device. Instead, the attacker targeted a fundamental vulnerability in the smart contract infrastructure managed by Rain, the firm that serves as the card-issuing backbone for Avici and numerous other self-custodial programs. By exploiting an authorization logic flaw—specifically, a signature-verification bypass in an outdated version of the Rain Solana contract—the attacker granted themselves administrative control over individual user collateral pools.

A Chronology of the August 28 Breach

The incident began at 13:40:41 UTC when the attacker’s wallet received 1.79 SOL via a deBridge cross-chain swap. After a 189-minute incubation period, the malicious activity commenced at 16:49:48 UTC. Over the next two and a half hours, the attacker successfully pushed through approximately 17,500 unauthorized transactions.

The mechanism was surgical: the attacker utilized a SubmitSignatures call paired with a manipulated Ed25519 instruction. By pointing signature, key, and message offsets back at the initial input, the attacker tricked the contract into accepting a single signature as the two required approvals for administrative access. Once granted "collateral admin" status, the attacker systematically emptied the accounts.

By 19:03:18 UTC, while the drain was still in progress, the stolen funds were being laundered. A total of 1,113,096.76 USDC was bridged to Ethereum, where it was subsequently funneled into the Tornado Cash mixer in standard tranches of 100, 10, 1, and 0.1 ETH. Rain initiated patches for the three affected program IDs at 19:18:37 UTC, 19:41:08 UTC, and 19:43:42 UTC. On September 5, nearly a week after the incident, Rain finally migrated the upgrade authority for these contracts to a Squads multisig vault, adding a layer of security that had been absent during the exploit.

The Myth of Non-Custodial Security

The August 28 event highlights a critical distinction between "user-owned keys" and "operator-controlled logic." Marketing materials for many crypto cards emphasize that users retain custody of their assets. However, as this breach demonstrated, even if a user holds their own keys, their funds are often held in smart contracts designed and maintained by a third-party program manager.

If that program manager holds the "upgrade key" to the contract, or if the contract is fundamentally flawed, the non-custodial label becomes a semantic shield rather than a security guarantee. The aftermath of the Avici drain was resolved only because Rain, backed by substantial venture capital funding, opted to cover the losses out of its own balance sheet. Had the company been insolvent or unwilling to act, the users would have had no legal recourse, as their funds were technically held in a smart contract for which they lacked ultimate administrative authority.

Industry Concentration and the "Third National" Factor

A deeper investigation into the infrastructure supporting these cards reveals a striking level of concentration. Seven of the 18 programs analyzed—including Avici, KAST, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria—name "Third National" as their issuer. Documents reveal that Third National is a dba for Nimbus LLC, a Puerto Rico-licensed money transmitter that is itself an affiliate of Rain.

This means that a significant portion of the self-custodial crypto card market is not supported by traditional chartered banks, but by a network of entities under a single corporate umbrella. Rain’s own regulatory disclosures note that they are not banks, do not provide FDIC insurance, and do not hold deposits. Instead, their business model relies on borrowing stablecoins to facilitate network settlement. When a user swipes their card, the transaction is effectively a charge card settlement financed by Rain’s liquidity network.

This concentration represents a systemic risk. While the August incident was contained, the vulnerability existed across multiple programs using the same codebase. The fact that Ether.fi Cash remained untouched during the attack is attributed to its distinct vault architecture, where user funds are managed through a Turnkey signer in an AWS Nitro enclave, rather than the standardized Rain collateral pools used by Avici and Tria.

Regulatory Pressures and the No-KYC Sector

Beyond the mainstream programs, the "no-KYC" crypto card sector continues to operate in a high-risk gray area. A review of 11 such cards—including SolCard, Laso Finance, and OffGrid—shows that only one program clearly identifies its issuer. Most rely on vague references to "licensed partners," and many carry high load fees that effectively serve as a premium for anonymous access.

The regulatory environment is shifting rapidly. The European Union’s Anti-Money Laundering Regulation (Regulation 2024/1624), set to apply in July 2027, will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing transactions from anonymous prepaid cards issued in third-party jurisdictions. This will likely force a consolidation of the market, as programs that rely on regulatory arbitrage find it increasingly difficult to secure merchant connectivity.

The Landscape of Custody Models

To navigate the market, investors and users must categorize cards into one of five distinct custody buckets, each with varying levels of risk:

1. Sold to the Operator: In this model, such as that employed by KAST, the user’s crypto is legally "sold" to the company upon transfer. The user holds a USD-denominated debt claim. In the event of bankruptcy, users are merely unsecured creditors.
2. Custodial (Affiliate): Programs like RedotPay hold assets in a group-affiliated trust. While this offers some oversight, it lacks the independence of third-party institutional custody.
3. Fiat-Converted: Cards like Crypto.com or Kraken’s Krak card do not hold crypto at all; they hold fiat currency. Once crypto is sold, the fiat is held by a licensed payment service provider, often protected by statutory safeguarding requirements in the EU or UK.
4. Shared Collateral Pools: This is the model used by Avici and Tria. While users own the collateral in a smart contract, the manager retains administrative authority, creating a single point of failure.
5. Direct Vaulting: This is the most secure tier, exemplified by Gnosis Pay or Ether.fi. These programs utilize self-custodial smart accounts where the user maintains control, and the card’s ability to pull funds is restricted by strictly scoped permissions and time-delay modules.

Future Implications

The collapse of Kulipa, the revocation of Paytend’s EMI license, and the winding down of Gnosis Pay’s consumer interface underscore a broader trend: the infrastructure of crypto cards is volatile. Even when the "non-custodial" promise holds true and users do not lose their funds, the underlying service can vanish overnight due to regulatory pressure or internal financial failure.

The August 2026 hack serves as a warning that the "non-custodial" label in the crypto card industry is often a misnomer. As the industry matures, the focus will likely shift toward transparency regarding contract ownership and issuer identity. Until then, users would be wise to treat their card-linked balances as temporary transit funds rather than long-term stores of value. For the $1.1 billion flowing through these cards monthly, the lesson is clear: convenience is often bought at the price of hidden, structural fragility. The industry’s ability to survive will depend on moving away from opaque, centralized collateral pools and toward the robust, transparent, and user-governed architectures that the category was originally intended to deliver.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet funded just three hours earlier with 1.79 SOL began systematically draining card-balance accounts held by users of Avici, a Solana-based neobank. The incident, which exposed a fundamental structural vulnerability in the rapidly growing "non-custodial" crypto card sector, resulted in the loss of $500,859.22 from 1,685 individual user accounts. By the time the breach was contained, the total impact across the ecosystem underscored the fragility of financial products that promise decentralization while relying on centralized technical infrastructure.

The drain did not target private keys or individual wallets directly. Instead, it exploited the specific smart contract architecture used by the card-issuing company, Rain. Rain serves as the back-end infrastructure provider for a significant portion of the self-custodial card market, including Avici and Tria, the latter of which also suffered losses. While Avici’s terms of service claimed that "Avici and Issuer will not, in any circumstance, be holding custody of your Collateral," the reality was more complex: the funds were held in smart contracts that, while technically distinct from the company’s own operating funds, were subject to upgrade authority held by a single, plain signing key controlled by the program manager.

The Anatomy of the August 28 Exploit

The breach followed a precise, automated trajectory. The attacker’s wallet, identified as 0xFVNFzq…nCEj, received 1.79 SOL via a deBridge cross-chain swap from Ethereum. After a three-hour period of inactivity, the wallet initiated a series of 21,405 transactions against Rain-controlled Solana programs. Approximately 17,500 of these attempts succeeded.

Each successful exploitation involved a three-step sequence: a "SubmitSignatures" call utilizing a native Ed25519 signature-verification instruction, followed by "AddCollateralAdmin" and "WithdrawCollateralAsset" calls. The vulnerability lay in the signature-verification logic. The attacker’s transaction pointed the signature, key, and message offsets of the second verification instruction back to the first, effectively tricking the contract into accepting one signature as two. This authorized the attacker to act as a "collateral admin" on over a thousand user accounts, granting them withdrawal permissions.

The median loss per user was approximately $24, though some accounts lost significantly more, with the largest single loss in tracked samples reaching $5,268. By 19:03 UTC, while the drain was still active, the attacker initiated a series of deBridge orders to bridge the stolen funds—swapped into ETH and SOL—back to the Ethereum mainnet. The total haul, amounting to approximately $1.11 million, was subsequently funneled through Tornado Cash in standard mixing increments.

The Role of Rain and the "Non-Custodial" Myth

The incident highlights a growing concentration of risk within the crypto card ecosystem. Rain is not merely a service provider; it is the infrastructure backbone for at least seven major card programs, including KAST, Avici, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria. Investigations into these programs reveal that "Third National"—the entity named in their terms of service as the card issuer—is an affiliate of Signify Holdings, Inc., which operates under the "Rain" brand.

This issuer is not a traditional chartered bank, but a Puerto Rico-licensed money transmitter. The business model, as outlined in Rain’s public filings and disclosures, involves facilitating card payments through a network of capital partners who lend stablecoins to settle credit card receivables. When a user swipes their card, Visa settles the transaction; Rain pays Visa using borrowed capital and is then reimbursed by the user’s smart contract collateral.

This model effectively makes these cards "charge cards" that are pre-financed by the issuer. The "non-custodial" label is therefore a marketing descriptor for the user’s interface, rather than a technical guarantee of total sovereignty. While the user retains ownership of the collateral in a smart contract, the contract’s code, upgrade authority, and security auditing remain under the control of the program manager.

Industry Response and Market Remediation

In the immediate aftermath of the August 28 exploit, the industry reaction was swift, albeit largely informal. Rain issued statements via X (formerly Twitter) confirming that a vulnerability in "outdated versions" of its Solana contracts had been exploited. Within 24 hours, Rain, Avici, and Tria confirmed that all affected users would be made whole, with the companies covering the losses from their own balance sheets—a testament to the high venture capital funding levels currently supporting these firms.

By September 5, Rain had migrated the upgrade authority for its core programs to a Squads multisig vault, a critical security upgrade that should have been in place prior to the deployment of the vulnerable code. Despite this, the lack of a formal, public post-mortem remains a point of concern for regulatory observers and security researchers.

The Broader Landscape: A $1.1 Billion Monthly Market

Paymentscan, an industry tracker, reported that crypto card volume reached $1.116 billion in August 2026, marking the second consecutive month of volume exceeding the $1 billion threshold. Cumulative volume since March 2023 now stands at $11.61 billion. However, this growth mask significant heterogeneity in custodial and operational models.

The market can be divided into five distinct categories of custody:

1. Sold to the Operator: Models like KAST, where user deposits are legally treated as a sale to the company, leaving the user with a debt claim against a firm that often operates in offshore jurisdictions with minimal liability caps.
2. Custodial Nominee: Programs like RedotPay or Revolut, where the operator holds legal title on behalf of the user, necessitating trust in the operator’s balance sheet and regulatory standing.
3. Fiat-Converted: Exchange-based cards (Crypto.com, Kraken, Bybit) where crypto is sold for fiat immediately upon or before the swipe, meaning the user holds zero digital assets at the point of payment.
4. Program-Pool Collateral: The Avici/Rain model, where assets are held in smart contracts under program-manager-controlled logic.
5. Direct Vault/Self-Custodial: The Gnosis Pay or Ether.fi Cash model, where the user maintains control via a self-custodial vault or smart account with specific, limited spend permissions.

Regulatory and Economic Implications

The regulatory environment is shifting rapidly. The EU’s Anti-Money Laundering Regulation (2024/1624), set to apply in July 2027, will effectively prohibit anonymous crypto-asset accounts and restrict the use of anonymous prepaid cards loaded from crypto-assets. This will likely force a consolidation in the "no-KYC" card market, which currently relies on loopholes involving business-level verification (Know Your Business) rather than individual-level scrutiny.

Infrastructure failures in 2026—including the collapse of Kulipa in July and the shutdown of Paytend Europe UAB in March—demonstrate that "self-custody" does not insulate a user from product-level failures. When an issuer loses its license or an infrastructure provider winds down, the card functionality ceases, regardless of whether the underlying collateral remains safe.

Conclusion: Assessing the Risk

For the average consumer, the distinction between these models is often buried in lengthy, complex terms of service. The August 2026 incident served as a stark reminder that in the world of crypto-native finance, terms like "non-custodial" are not synonymous with "risk-free."

While the rapid reimbursement of victims in August demonstrated a commitment to brand protection, it was a discretionary act of corporate goodwill rather than a systemic guarantee. As the volume of crypto-card transactions continues to scale, the industry faces an unavoidable choice: either move toward more transparent, fully auditable self-custodial architectures—like those championed by Gnosis Pay or Ether.fi—or accept that their users remain vulnerable to the same single-point-of-failure risks that have plagued traditional fintech and banking for decades. The future of the category depends not on marketing, but on whether the industry can move beyond the "black box" of proprietary smart contract administration and into an era of verifiable, decentralized trust.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL via a modest $190 USDC bridge from Ethereum—began systematically draining card-balance accounts associated with Avici, a prominent Solana-based neobank. The event marked a critical stress test for the burgeoning "non-custodial" crypto card sector, a category that has seen its monthly volume surge to over $1.1 billion by August 2026. While Avici’s terms of service, last updated in mid-2025, assured users that neither the company nor its issuer would hold custody of collateral, the reality of the technical architecture proved more vulnerable than the legal language suggested.

By the time the reconciliation was finalized, Avici confirmed that 1,685 users had lost a total of $500,859.22. The funds were held within a shared Solana card contract infrastructure utilized by Avici and several other programs, all managed by Rain, the card-issuing company that currently serves as the backbone of much of the self-custodial card market. In the immediate aftermath, Rain moved to cover every refund, with Avici and Tria—a second program hit by the same vulnerability—adding an additional 10% on top of the losses to appease their user base.

A Chronology of the August 28 Exploit

The exploit was characterized by precision and speed. The attacker’s wallet, identified as 0xFVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, remained dormant for 189 minutes after its initial funding before launching the attack. Over the next two and a half hours, the wallet executed approximately 21,405 transactions, with 17,500 successfully bypassing security protocols.

The technical flaw lay in the signature-verification logic of the Rain-managed Solana program. The attacker utilized a SubmitSignatures call paired with a native Ed25519 verification instruction. By cleverly pointing the signature, key, and message offsets of the second verification instruction back at the first, the attacker was able to satisfy a two-signature requirement with a single valid signature. This effectively granted the attacker "collateral admin" status on over a thousand individual accounts, allowing for the subsequent unauthorized withdrawal of assets.

The impact was localized but significant. While the median loss per user was roughly $24, some accounts lost upwards of $5,000. It was not a breach of private keys or a compromise of individual user wallets; rather, it was an authorization bug within the program’s logic. By 19:18 UTC, Rain had begun deploying patches to the affected program IDs. By early September, the company had migrated the upgrade authority for these programs to a secure Squads multisig vault, effectively centralizing the "master key" that had previously been held by a single, vulnerable keypair.

The Ecosystem: Tracking $1.1 Billion in Monthly Flow

Data from Paymentscan indicates that the crypto card sector has reached a mature, if volatile, state. In August 2026, the sector recorded $1.116 billion in volume across 11 million transactions and nearly 290,000 active addresses. This figure represents a dramatic rise from the $153 million recorded in December 2024.

However, these figures require careful interpretation. A significant portion of this volume—roughly 42%—is attributed to programs settling through Rain. When combined with self-reported data from major players like RedotPay, two entities effectively account for nearly 78% of all tracked crypto card volume. The industry is characterized by significant concentration, which, while efficient, creates systemic points of failure. The collapse of institutions like the Bank of Lithuania’s revocation of Paytend’s license earlier in 2026 serves as a reminder that the underlying financial rails are often more fragile than the consumer-facing brand.

Understanding Custody Models: The Five Tiers of Risk

To understand how users’ money is handled, one must distinguish between five primary custody models identified across the 18 major card programs analyzed:

1. Sold to the Operator: In models like KAST, user deposits are legally framed as a "sale" of assets to the platform. The user holds a USD-denominated debt claim against the operator, meaning that in the event of bankruptcy, users are treated as unsecured creditors.
2. Held in Custody: Platforms like RedotPay or Revolut maintain assets in custodial accounts. While the user is the beneficial owner, the platform maintains legal title, creating a reliance on the operator’s solvency and regulatory standing.
3. Fiat Conversion: Exchanges like Crypto.com and Kraken often convert crypto to fiat at the moment of the swipe. The crypto itself never sits on the card, and the fiat portion is handled by licensed e-money institutions subject to statutory safeguarding requirements.
4. Shared Collateral Contracts: This is the model used by Avici, Tria, and Rain. While "non-custodial" in the sense that the user controls their own wallet, the card-spending mechanism requires funds to be moved into a smart contract managed by a third party. As seen in August, this "non-custodial" promise is only as secure as the underlying smart contract code and the operator’s upgrade authority.
5. User-Controlled Vaults: The most robust model, utilized by Gnosis Pay and Ether.fi Cash, involves the user holding their own vault. Spend permissions are scoped strictly to the card, and the operator cannot move funds independently. Even here, however, complex "roles" and "delay" modules have previously been targeted by attackers.

The Role of "Third National" and Regulatory Implications

A critical, often overlooked finding is that many of these self-custodial programs name "Third National" as their card issuer. Investigations reveal that Third National is not a traditional chartered bank, but rather a Puerto Rico-based money transmitter operating as part of the Rain group. This is a vital distinction for consumers: Rain and its affiliates explicitly state they are not banks, do not provide FDIC insurance, and do not hold deposits.

The business model relies on a network of capital partners who lend stablecoins to facilitate network settlement for credit card receivables. When a user swipes, Visa settles with the merchant, Rain pays Visa from borrowed stablecoins, and the user’s contract is then liquidated to repay that loan. This infrastructure is scaling at an institutional pace, with heavyweights like Western Union, Ethena, and MoneyGram integrating with the Rain network.

Broader Implications for the "No-KYC" Market

Parallel to the mainstream programs, the "no-KYC" (Know Your Customer) card market remains a high-risk niche. Analysis of 11 such cards reveals a consistent lack of transparency regarding the issuing entity. Most rely on the "business verification" loophole, where a company completes business-level KYC and then issues cards to individuals as "authorized spenders."

Regulators are closing in on these gaps. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, applicable from mid-2027, will effectively prohibit anonymous crypto-asset accounts and restrict the use of anonymous prepaid cards issued in third countries. As industry experts have noted, the no-KYC status is rarely a permanent feature; it is often a temporary state that ends abruptly when a BIN sponsor or network regulator demands compliance.

The Path Forward: Lessons from 2026

The August 28 incident was a wake-up call regarding the nomenclature of "non-custodial" crypto products. In the marketing materials of these programs, "non-custodial" implies safety. In the fine print of a cardholder agreement, however, it merely defines who cannot move your funds during normal operation. It says nothing about who wrote the contract, whether the code was audited, or who holds the keys to upgrade the protocol.

The fact that Avici and Tria users were made whole was not due to the inherent security of the smart contract, but rather the decision of a well-capitalized private company to absorb the loss to preserve its reputation. This highlights the paradox of the modern crypto-card sector: users are seeking the autonomy of self-custody while relying on the centralized balance sheets of venture-backed firms to act as the ultimate backstop.

For the end user, the lesson is clear. Before funding a crypto-linked card, one must move past the marketing. The key questions are: Is the asset truly in my control, or is it in a contract I cannot access? Who is the legal issuer? What happens to my balance if the issuer loses its license? And perhaps most importantly, who holds the ability to upgrade the smart contract that governs my collateral? As the industry continues to scale, transparency regarding these technical and legal structures will become the deciding factor between a sustainable financial tool and a recurring systemic risk. The growth of the sector to over $1 billion in monthly volume proves there is a massive appetite for these products, but the infrastructure remains in its infancy, characterized by rapid iteration, frequent failures, and a heavy reliance on the integrity of the entities behind the code.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana-based wallet—funded just three hours earlier with 1.79 SOL via a $190 USDC bridge from Ethereum—executed a sequence of transactions that exposed a critical vulnerability in the infrastructure of several prominent crypto-native neobanks. By the time the exploit concluded, 1,685 users of Avici, a Solana-based financial platform, had seen their card-balance accounts drained of a combined $500,859.22. This incident, while rapidly contained, has cast a harsh light on the "non-custodial" card industry, a sector that has seen its monthly volume swell to over $1.1 billion as of August 2026, according to data from Paymentscan.

The breach was not a result of compromised user keys or illicit wallet access. Instead, it targeted the core architecture of the card programs themselves. The funds were stored in smart contracts that, while billed as non-custodial, remained under the administrative control of the program manager—in this case, Rain, the infrastructure firm powering Avici and a host of other self-custodial card programs. This event serves as a stark reminder that in the nascent world of crypto-payments, the distance between marketing claims and technical reality can be measured in lines of code and upgrade keys.

The Anatomy of the August 28 Drain

The exploit followed a precise, automated cadence. The attacker’s address, identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, initiated nearly 21,400 transactions against Rain-controlled Solana programs. The vulnerability relied on a flaw in the SubmitSignatures call within the smart contract’s native Ed25519 signature-verification instruction. By manipulating signature and key offsets, the attacker bypassed the requirement for two-factor approval, effectively granting themselves "collateral admin" privileges on over a thousand individual user accounts.

Once elevated to administrator status, the attacker systematically emptied the collateral balances, siphoning funds into a series of deBridge orders that ultimately funneled the stolen assets to Ethereum. By 19:49 UTC, approximately 456 ETH—valued at roughly $1.1 million—had been funneled through the Tornado Cash mixing service.

While the total impact reached approximately $1.1 million across Avici and Tria, the resolution was swift. Rain, the infrastructure provider, covered the full amount of the stolen funds, with Avici and Tria adding an additional 10% premium for affected users. Despite the rapid reimbursement, the incident highlighted a fundamental concentration risk: three distinct Rain-managed program IDs were using a single, plain keypair for upgrade authority. It was not until September 5, nearly a week after the incident, that Rain moved these administrative controls to a Squads multisig vault, a security standard that should have been in place at inception.

Market Growth and the Custody Conundrum

The rapid growth of the crypto-card market has outpaced the development of robust regulatory frameworks. Paymentscan data reveals that monthly volume surged from $153 million in December 2024 to $1.116 billion by August 2026. This trajectory is fueled by a mix of institutional interest and the promise of "borderless" spending. However, beneath the headline figures lies a complex web of custody models that dictate whether a user’s assets are truly their own or merely a debt claim against a private entity.

These models generally fall into five categories:

1. Sale to Operator: Models like KAST, where assets are technically "sold" to the company in exchange for a ledger entry. In the event of bankruptcy, users become unsecured creditors.
2. Standard Custody: Programs like RedotPay, where assets are held in a traditional custodial wallet, subject to the terms of the custodian.
3. Fiat Conversion: Cards like Crypto.com and Kraken, which hold no crypto at the point of sale, converting assets to fiat via licensed partners.
4. Program-Managed Collateral: The model utilized by Avici and Tria, where user assets sit in smart contracts managed by a third party.
5. Self-Custodial Vaults: The most secure model, utilized by Gnosis Pay and Ether.fi Cash, where the user retains control over the underlying smart contract or vault, often with specific spending modules that limit the operator’s ability to move funds.

The reliance on "Third National," a Puerto Rico-based money transmitter, as the primary issuer for at least seven of the programs surveyed, further complicates the landscape. Unlike a chartered bank, Third National operates under money transmitter licensing, and its relationship with users is governed by specific contractual obligations rather than federal banking protections like FDIC insurance.

The Regulatory Horizon and Industry Consolidation

The regulatory environment is bracing for a significant shift. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, set to apply from July 2027, is poised to effectively end the "no-KYC" (Know Your Customer) card model by prohibiting anonymous crypto-asset accounts and restricting the use of anonymous prepaid cards issued in third-party jurisdictions.

This regulatory pressure, combined with the technical failures seen throughout 2026, is driving a consolidation of the market. The collapse of institutions like Paytend, the closure of Kulipa’s operations, and the recent decision by Gnosis Pay to wind down its consumer interface demonstrate that the infrastructure behind these cards is fragile. The market is shifting away from the experimental, high-fee "no-KYC" services toward platforms that integrate directly with established financial institutions and utilize verified, audited smart-contract architectures.

Lessons from the August 2026 Breach

The incident in August was not a failure of self-custody as a concept, but a failure of operational security within a shared infrastructure. The fact that Ether.fi users were unaffected—despite using similar technology—is a testament to the importance of the specific smart-contract implementation. Ether.fi’s use of a "Turnkey" signer inside an AWS Nitro enclave, combined with an operator-shaped backstop, provides a different security profile than the Rain-managed contracts.

For the end user, the lesson is clear: the term "non-custodial" in a cardholder agreement is a legal description of who owns the assets, not a technical guarantee of security. Users must look beyond the marketing and evaluate the following:

• Upgrade Authority: Who holds the keys to change the smart contract code?
• Issuer Identity: Is the issuer a regulated bank, or a money transmitter with opaque financial obligations?
• Insolvency Provisions: Does the legal language explicitly protect the user’s assets in the event of the company’s bankruptcy?
• Real-time Settlement: Does the platform rely on a third-party administrative layer that could be compromised?

As the industry matures, the promise of $1.1 billion in monthly volume must be backed by a corresponding maturity in security practices. The era of "move fast and break things" in financial infrastructure is colliding with the reality of millions of dollars in consumer assets. While the August 2026 exploit resulted in a full recovery for users, the industry may not be as fortunate during the next systemic vulnerability. Transparency, public audits of contract code, and the migration to decentralized upgrade authority are no longer optional features—they are the minimum requirements for a sustainable crypto-card ecosystem.

Looking ahead, the role of institutional players like Visa, which is increasingly sharing settlement data with on-chain lenders, suggests that the future of crypto-cards will be defined by integration rather than isolation. The challenge for these programs will be to maintain the "crypto-native" benefits of speed and global access while adopting the rigorous security and regulatory standards that have defined traditional banking for centuries. For now, the user must remain the final arbiter of risk, carefully vetting the underlying architecture of any platform that promises to turn their digital assets into spendable capital.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of transactions that would systematically drain the card-balance accounts of users on Avici, a prominent Solana-based neobank. This breach, which ultimately compromised the funds of 1,685 users, totaling over $500,000, exposed the fragile architecture underpinning the rapidly expanding market of non-custodial crypto debit cards. While Avici’s terms of service, last updated in June 2025, explicitly assured users that neither the company nor its issuer would hold custody of collateral, the reality of the smart contract design proved far more vulnerable than the legal disclaimers suggested.

The breach was not a traditional theft of private keys, nor was it a compromise of user-held wallets. Instead, it was an exploit of the "program manager" layer—a central point of failure in many contemporary self-custodial card designs. The affected funds were stored in smart contracts that, while technically accessible by the user, remained under the control of a program manager who held the authority to upgrade the code using a single, plain signing key.

A Chronology of the August 28 Breach

The exploit occurred within a remarkably narrow window of time. Between 16:49:48 UTC and 19:18:52 UTC, the attacker’s wallet (FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj) executed 21,405 transactions, of which approximately 17,500 were successful. The methodology involved exploiting an authorization bug within the Rain-controlled Solana card program. Specifically, the attacker leveraged a signature-verification flaw where a single Ed25519 signature could be reused to satisfy a dual-signature requirement for administrative actions. By doing so, the attacker granted themselves "collateral admin" status on over a thousand individual user accounts, subsequently draining them.

The impact was swift and severe. By 19:03 UTC, while the drain was still active, the attacker had already begun laundering the proceeds through deBridge, converting the stolen assets into 418.11 ETH and 90,925 USDC. By 19:49 UTC, these funds were funneled through Tornado Cash in a standardized ladder of deposits. The total amount bridged out was approximately 1.11 million USDC. Following the exploit, the value of the AVICI token plummeted by 49%.

The Role of Rain and the Third National Issuer

The incident brought intense scrutiny to Rain, the card-issuing infrastructure company that serves as the backbone for a vast portion of the self-custodial card market. Investigation revealed that the exploit impacted three distinct Rain program IDs. Rain’s infrastructure is not, as many users assume, a decentralized banking protocol. It is a sophisticated, centralized stablecoin-powered payment layer. Rain is the trade name for Signify Holdings, Inc., and its issuing entity, "Third National," is a licensed Money Transmitter in Puerto Rico—not a chartered bank or a regulated Electronic Money Institution (EMI).

Rain’s business model relies on a network of capital partners who borrow stablecoins to facilitate network settlement for credit card receivables. When a user swipes a "non-custodial" card, Rain pays Visa from these borrowed funds and is subsequently repaid from the user’s smart contract collateral. This structure means that even in "non-custodial" models, the card is essentially a charge card financed by Rain’s corporate treasury.

The Landscape of Crypto Card Custody

To understand the risks, one must categorize the five distinct custody models currently dominating the $1.1 billion monthly crypto card market:

1. Sold to the Operator: Programs like KAST treat user deposits as a "sale" of assets to the company, effectively turning the user into an unsecured creditor. In the event of bankruptcy, users are relegated to the status of general creditors, often behind senior debt.
2. Custodial Held for You: Platforms like RedotPay and Revolut act as custodians. While they claim to hold assets on behalf of the user, the legal reality is often obscured by general liens and affiliate relationships.
3. Fiat Conversion at Licensed Issuers: Traditional exchange cards (Crypto.com, Kraken, Bybit) do not hold crypto on the card. They convert assets to fiat at the moment of sale. In the EU, these programs fall under EMI regulations, which provide statutory protections through "safeguarding" of fiat funds.
4. Shared Pool Collateral: This category, which includes the Avici and Tria models, relies on user-funded smart contracts. While the user technically owns the collateral, the upgrade authority for the smart contract often rests with the operator, creating a single point of failure.
5. Vault-Based Debits: Programs like Gnosis Pay and Ether.fi Cash utilize advanced smart account structures (e.g., Gnosis Safes) that limit the operator’s ability to move funds. Even here, however, reliance on "corporate signers" for recovery creates a nuanced security profile.

Market Data and Regulatory Headwinds

According to Paymentscan, the total volume for crypto-linked cards in August 2026 reached $1.116 billion, representing a 32% increase since March 2026. However, these figures come with significant caveats. Much of the "volume" is self-reported by operators like RedotPay, or represents proxy settlement batches rather than actual on-chain spend. The reliance on Rain-managed programs is particularly high, with roughly 42% of the market volume flowing through its infrastructure.

The regulatory environment is shifting rapidly. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, effective in July 2027, will impose strict prohibitions on anonymous crypto-asset accounts and offshore anonymous prepaid cards. This will likely force a consolidation of the "no-KYC" card market, as issuers will no longer be able to hide behind the ambiguity of corporate-entity verification.

Response and Remediation

In the wake of the August 28 incident, the response from Rain and its partner brands was rapid, if somewhat opaque. By September 5, Rain had moved the upgrade authority for its affected programs to a Squads multisig vault, a significant security improvement that removed the single-key risk. Furthermore, all affected users were made whole within 24 hours, with Avici and Tria funding the refunds from their respective balance sheets.

While the financial loss was mitigated by the companies’ decision to cover the costs, the incident serves as a stark reminder that the term "non-custodial" in a cardholder agreement is a legal description of current state, not a guarantee of future security. It says nothing about the provenance of the deployed code, the rigor of audits, or the security of the upgrade keys.

Analysis: The "Non-Custodial" Fallacy

The fundamental lesson from the August 2026 crisis is that users often conflate "non-custodial" with "unhackable." In reality, when a user deposits funds into a card-linked smart contract, they are entering a trust relationship with the developer who wrote the contract and the program manager who controls the upgrade key.

The fact that Gnosis Pay, a pioneer in the space, is winding down its consumer interface while its underlying infrastructure persists, highlights the volatility of this sector. Companies are pivoting away from direct consumer interfaces toward white-label infrastructure, effectively shifting the burden of compliance and security further down the supply chain.

As the industry matures, the disparity between platforms will widen. Users should prioritize programs that:

• Clearly name their legal issuer (and verify if it is a licensed bank or EMI).
• Publicly disclose their smart contract addresses.
• Utilize multisig or timelock modules for contract upgrades.
• Maintain clear, unambiguous language regarding insolvency protection.

The resilience of the crypto-card market depends on whether these firms can move beyond the "move fast and break things" ethos that characterized the 2025-2026 growth spurt. As the market approaches $1.5 billion in monthly volume, the reliance on single-issuer infrastructure—like the Rain-Third National nexus—represents a systemic risk that regulators and users alike will increasingly demand be addressed through radical transparency and technical decentralization. For now, the "non-custodial" promise remains a work in progress, often held together more by venture-backed balance sheets than by the underlying code itself.

At 16:49:48 UTC on Friday, August 28, 2026, a specific Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in bridged Ethereum-based USDC—initiated a systematic drainage of card-balance accounts held by users of Avici, a prominent Solana-based neobank. This incident exposed a critical vulnerability in the architecture of modern "non-custodial" crypto cards, triggering a cascade of concern across the $1.1 billion-a-month sector. While the term "non-custodial" often implies complete user autonomy, the August 28 exploit demonstrated that even when users hold the keys to their primary wallets, the smart contracts utilized for card-based spending often remain under the centralized administrative control of the card issuer.

The fallout was immediate. By 20:44 UTC that same day, Avici confirmed via its official communication channels that 1,685 users had lost a collective $500,859.22. The funds were siphoned from a shared Solana card contract infrastructure utilized by Avici and several other programs. The underlying technology belonged to Rain, a card-issuing firm that serves as the backbone for a substantial portion of the self-custodial card market. In a swift move to preserve market confidence, Avici announced that Rain had committed to covering 100% of the stolen funds, with both Avici and Tria—a second program hit by the exploit—contributing an additional 10% premium to affected users.

The Anatomy of the Exploit

The incident was not a result of compromised user private keys or a phishing attack on individual wallets. Instead, it was an authorization bug within the smart contract logic itself. Investigators found that the attacker’s wallet exploited a signature-verification flaw in the Rain-controlled Solana program. The exploit involved a SubmitSignatures call paired with a native Ed25519 signature-verification instruction. By cleverly manipulating the signature, key, and message offsets, the attacker was able to force the system to accept a single signature as fulfillment for a two-signature requirement.

This maneuver effectively granted the attacker administrative status over more than 1,000 individual user collateral accounts. Once granted "admin" status, the attacker had the authorization to initiate WithdrawCollateralAsset calls. The median loss per user was approximately $24, though the largest single loss in the sample reached $5,268.

The attacker’s efficiency was notable. The entire drainage operation lasted less than two and a half hours, during which 21,405 transactions were attempted, with roughly 17,500 succeeding. The stolen funds were bridged out to Ethereum and funneled through the Tornado Cash mixer in a standard "ladder" of transactions—four deposits of 100 ETH, five of 10, five of 1, and nine of 0.1—effectively obfuscating the trail.

Broader Industry Context and Data Trends

According to Paymentscan, the crypto card industry reached a significant milestone in August 2026, with total volume hitting $1.116 billion across 11 million transactions. This represents a staggering rise from $153 million in December 2024. However, analysts warn that these headline figures must be interpreted with caution. The data is heavily influenced by self-reported figures from firms like RedotPay, which accounted for roughly 36% of the August volume.

The industry currently relies on a handful of key infrastructure providers. Rain alone accounts for approximately 42% of all tracked volume when combined with RedotPay, meaning two entities control nearly 78% of the crypto-card market. This high level of concentration suggests that while the industry is growing rapidly, it is increasingly susceptible to systemic failures if the underlying infrastructure is compromised.

The "Non-Custodial" Terminology Debate

The August 28 exploit reignited a fierce debate regarding what "non-custodial" actually means in the context of consumer financial products. While Avici’s terms of service, last updated in June 2025, explicitly stated that the company would not hold custody of user collateral, this proved to be a legal distinction that did not translate into technical reality.

For the purposes of a card program, funds must exist in a state that can be liquidated to settle with payment networks like Visa. This creates a "custody gap." Programs like Gnosis Pay attempt to mitigate this by utilizing a "Safe" architecture, where the user maintains ownership through a smart contract that the operator cannot unilaterally move. In contrast, other models—such as the one used by KAST—rely on a "sale-to-operator" model. Under the KAST terms, as revised in July 2026, transferring assets to the platform constitutes a sale, turning the user’s crypto into a USD-denominated debt claim against the company. This effectively strips the user of ownership, leaving them as unsecured creditors in the event of bankruptcy.

The Role of Third National and Rain

A critical finding in the investigation of the August 28 event is the central role played by "Third National." Seven of the programs reviewed—KAST, Avici, Ether.fi Cash, Plasma One, Solayer, Payy, and Tria—name Third National as their card issuer. However, Third National is not a bank in the traditional, chartered sense. It is a Puerto Rico-licensed money transmitter operating under Nimbus LLC, an affiliate of the Rain group.

This structure allows these companies to bypass many of the regulatory hurdles associated with traditional banking, but it also means that users do not benefit from FDIC insurance or traditional bank-level protections. When a user taps their card, Visa settles the transaction; Rain pays Visa using borrowed stablecoins; and Rain is subsequently reimbursed from the user’s smart contract collateral. This "charge card" model, financed by institutional stablecoin borrowing, is highly scalable but introduces significant counterparty risk.

Regulatory and Operational Risks

The fragility of the current crypto-card landscape is evidenced by the frequent shutdowns and license revocations seen throughout 2026. The collapse of the Kulipa infrastructure in July, which affected several card programs, and the revocation of Paytend’s e-money license in Lithuania earlier in the year, serve as reminders that the regulatory environment is tightening.

The European Union’s upcoming Anti-Money Laundering Regulation (EU 2024/1624), set to apply from July 2027, will likely eliminate the "no-KYC" card category entirely. Article 79 of the regulation explicitly prohibits the maintenance of anonymous crypto-asset accounts and bars EU acquirers from processing payments from anonymous prepaid cards issued in third countries. This will force a massive shift in the industry toward standard KYC compliance, potentially ending the era of "privacy-first" cards that lack identifiable issuers.

Lessons Learned and Future Implications

The primary takeaway from the August 2026 exploit is that technical audits are only as good as the code actually deployed to the mainnet. Rain’s post-mortem indicates that the vulnerability existed in an outdated version of their Solana contracts that had remained live long after a patch was developed. While Rain’s proactive decision to refund users in full prevented a total loss of trust, it also highlighted the dangerous reliance on centralized upgrade authority.

By September 10, Rain had moved the upgrade authority for its programs to a Squads multisig vault, a necessary step to decentralize the risk of future contract manipulation. However, the reliance on a single issuer for a large swath of the market remains a vulnerability.

Ultimately, the distinction between a "custodial" and "non-custodial" card program is becoming increasingly blurred by the operational requirements of the payment networks. Consumers are advised to look beyond marketing slogans and specifically evaluate five criteria:

1. Ownership status: Does the contract represent a sale of assets or a true smart-contract vault?
2. Issuer transparency: Is the issuer a recognized financial institution, or an opaque affiliate of the program manager?
3. Insolvency protections: What legal rights exist if the program manager fails?
4. Upgrade Authority: Who has the power to change the code governing the funds?
5. Data Verifiability: Is the reported volume based on transparent on-chain data or self-reported platform metrics?

As the industry matures, the "move fast and break things" mentality that characterized the early adoption of crypto cards is facing a collision with the realities of global financial regulation. For the 1,685 users affected by the Avici exploit, the outcome was positive, but it was a result of corporate goodwill, not the inherent safety of the system. In the future, the stability of the sector will likely depend on moving away from centralized administrative control over collateral and toward architectures that provide verifiable, cryptographically guaranteed user control.

At 16:49:48 UTC on Friday, August 28, 2026, a Solana wallet—funded just three hours prior with 1.79 SOL derived from $190 in USDC bridged from Ethereum—initiated a series of commands that began systematically draining card-balance accounts held by users of Avici, a Solana-based neobank. By the time the event concluded, 1,685 users had seen their balances liquidated, totaling a loss of $500,859.22. This incident, while localized to a specific set of smart contracts, exposed the precarious structural reality behind the rapidly expanding market for "non-custodial" crypto debit cards.

The drain was facilitated not by a theft of private keys or a compromise of individual user wallets, but by a critical authorization vulnerability within a shared smart contract infrastructure used by Avici and several other programs. This contract was managed by Rain, a prominent card-issuing infrastructure provider. Although Avici’s terms of service, last updated in June 2025, explicitly stated that neither Avici nor the issuer held custody of user collateral, the technical reality was that the program manager maintained the ability to upgrade these contracts using a single, plain signing key.

A Chronology of the August 28 Breach

The exploit demonstrated the speed and precision with which vulnerabilities in smart contract architecture can be weaponized. The attacker’s wallet, identified on the Solana ledger as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj, sat idle for 189 minutes after receiving its initial funding. Between 16:49:48 UTC and 19:18:52 UTC, the wallet executed 21,405 transactions, of which approximately 17,500 were successful.

The mechanism was an authorization bypass. Each successful transaction interacted with a Rain-controlled program, utilizing a SubmitSignatures call paired with native Ed25519 signature-verification instructions. The attacker discovered that by pointing the signature, key, and message offsets of the second verification instruction back to the first, they could satisfy a two-signature requirement with a single signature. This allowed the attacker to designate themselves as a "collateral admin" for over a thousand individual user accounts, granting them the privilege to withdraw assets.

The impact was swift. By 19:03:18 UTC, while the drain was still in progress, the attacker had already begun bridging stolen assets. A series of deBridge orders moved over 1.1 million USDC from the Solana network to Ethereum. These funds were subsequently funneled through the Tornado Cash router, effectively masking the trail of the stolen capital. While the total volume across all impacted programs exceeded $1.1 million, the specific losses at Avici were eventually covered in full, with the firm and its partners adding a 10% premium for affected users—a move that likely saved the company’s reputation in the short term.

The Landscape of Crypto Card Custody

The "non-custodial" label in the crypto card sector is often a marketing term that belies a complex web of legal and technical arrangements. An analysis of 18 different card programs reveals five distinct custody models, ranging from direct sale to the operator to robust, user-controlled smart vaults.

The most controversial is the "Sale to Operator" model, exemplified by KAST. Following a public feud with Ether.fi’s CEO Mike Silagadze, KAST updated its terms in July 2026 to clarify that user assets transferred to the platform are considered sold to the company. In exchange, the user receives a "legally binding and enforceable payment obligation"—essentially becoming an unsecured creditor. If the platform faces insolvency, users have no claim to the original assets, only a debt claim against a potentially insolvent entity.

Conversely, programs like Gnosis Pay utilize a "Self-Custodial Vault" model. Here, the user retains control of a smart contract wallet—a "Safe"—that the operator cannot move. Spend permissions are scoped specifically to the card, and a "Delay module" provides a buffer for transactions. This model represents the gold standard for on-chain autonomy, as the funds remain outside the reach of the platform’s potential bankruptcy estate.

The Role of "Third National" and Issuer Concentration

A significant portion of the self-custodial card market relies on a single issuer: Third National. This entity, which is not a chartered bank but rather a Puerto Rico-licensed money transmitter operating under the Signify Holdings umbrella, serves as the issuer for Avici, Ether.fi Cash, Plasma One, Solayer, Payy, Tria, and KAST.

This concentration of infrastructure creates a systemic dependency. When Rain—the parent company of Third National—experienced the contract exploit on August 28, it was not merely an Avici issue; it was a structural issue for every program utilizing those specific contract versions. While Rain successfully patched the affected programs and moved upgrade authorities to a multi-signature Squads vault by September 5, the incident highlighted the "key-person risk" inherent in relying on a single infrastructure provider for the majority of the market’s "non-custodial" solutions.

Market Growth and Regulatory Realities

Despite these technical failures, the crypto card market continues to expand at an aggressive pace. Data from Paymentscan indicates that monthly transaction volume rose from $153 million in December 2024 to $1.116 billion by August 2026. This growth is driven by the increasing integration of stablecoin-powered payments into the global financial system. Visa’s recent announcement that its stablecoin-linked card programs have surpassed a $20 billion annualized run rate underscores the scale of this transition.

However, the regulatory environment is tightening. The European Union’s Anti-Money Laundering Regulation (EU) 2024/1624, which becomes fully applicable in July 2027, will effectively prohibit anonymous crypto-asset accounts and bar EU acquirers from processing payments from anonymous prepaid cards issued in third-party jurisdictions. This shift will likely force a consolidation in the "no-KYC" (Know Your Customer) card market, as many of these programs rely on regulatory arbitrage that will no longer be sustainable.

The "No-KYC" Market: A Niche Product

The sub-sector of "no-KYC" crypto cards, often promoted as a privacy-centric alternative, remains fraught with instability. Many of these cards—such as Laso, Freedomia, and SolCard—operate in a grey area, frequently changing issuers or facing sudden service terminations when a bank or payment network revokes their access. As noted by industry observers, these cards are often "niche products" that serve as a temporary bridge rather than a stable financial solution. The "loading fees" of 2% to 5% are, in effect, the premium users pay for the privilege of accessing a BIN (Bank Identification Number) that remains opaque to the user and the regulator.

Analysis: Lessons from the August Drain

The primary takeaway from the August 2026 exploit is not that self-custody failed, but that the implementation of "non-custodial" promises is only as robust as the smart contract code and the governance of the upgrade keys.

The fact that Avici and Tria users were made whole within 24 hours was not due to the inherent security of the "non-custodial" design, but due to the willingness of the program manager to absorb the loss from their own balance sheet. In the event of a larger, systemic failure where the platform lacks the venture capital reserves to reimburse users, the "non-custodial" claim might provide little legal comfort to those who have essentially parked their liquidity in an un-audited or outdated smart contract.

Moving forward, the industry is likely to see a divergence. Institutional-grade programs will likely move toward more transparent, multi-sig controlled, and audited vault architectures, while retail-facing programs may face increased regulatory pressure to adopt standard banking compliance. For the end-user, the lesson is clear: check the legal terms for "sale" language, verify the identity of the issuer, and ensure that the smart contract governing your collateral is not subject to the unilateral, single-key upgrade authority of an opaque intermediary. As the sector matures, the distinction between "marketed as non-custodial" and "technically non-custodial" will become the most important metric for any cardholder.