Why A Crypto Card Might Be A Leaking Bucket
Shawn Yu, ROZO Co-founder, building Visa Layer for Stablecoins.
gettyOn August 28, Rain, a Visa principal member supplying the stablecoin card infrastructure behind consumer crypto cards, posted that its monitoring systems had found a “vulnerability impacting a small number of programs using an outdated version of our Solana contracts.” Those programs were upgraded, forensic experts were brought in and the company said, “All affected users will be made whole.” Avici, a self-custodial neobank affected by this incident, reported 1,685 users and $500,859 in card balances gone, and the company pledged full refunds to those affected.
I don’t doubt those balances will be restored. A cardholder who woke up that morning had no way of knowing anything was wrong, no way of stopping it and no choice but to wait for a company to decide whether, and how, to fix it. That is not a bug in one program. It is what a crypto card is.
The pitch is simple: Keep your bitcoin or stablecoins, tap a card and earn 3% to 5% back. Between your wallet and the coffee shop sit a custodian holding your balance, a program manager running the card, a sponsor bank whose BIN it is issued under, a processor authorizing the swipe and the network that clears it. There are five parties at play here, each with its own contracts, security posture, regulatory obligations and power to say no.
Every party is a hole in the bucket. Custodians can get hacked. Program managers can ship outdated contracts and the layer beneath can stop.
In June 2020, the U.K.’s Financial Conduct Authority suspended Wirecard Card Solutions, and cardholders of Crypto.com, TenX and Cryptopay lost access to their cards overnight. This was not because they did anything or because their provider did, but because a company several layers down the stack had a bad week.
Card networks have derisked entire categories before; processors have frozen accounts over a flagged pattern. Cashback is water poured in at the top. It does not fix the holes. It keeps the level looking fine until the day it doesn’t.
For a business, each intermediary adds another dependency. A failure anywhere in that chain can leave the company unable to pay suppliers or access its own working capital.
Crypto card launches are now an influencer business. Comparison videos rank cards by reward rate, FX spread, metal versus plastic and airport lounge access. They rarely ask:
• Which legal entity holds my funds right now, and can I see that the money is there?
• If the program is shut down tomorrow, how do I get my balance out and who do I call?
• If the custodian loses the funds, is being “made whole” a legal obligation or a promise?
A 5% rebate on $3,000 in monthly spending is $150. Losing access to a $3,000 balance for six weeks while a program migrates costs far more.
I have spent years building payment rails for merchants who accept crypto directly. My concern is not that cards get hacked; everything gets hacked. It is structural. There are three things you lose the moment you deposit funds with an intermediary:
1. Observability: On-chain, I can track my funds, including balances, transactions, counterparties and settlement status. The moment funds cross into a card program, that ends. I get a dashboard showing a number the company chooses to show me.
2. Substitutability: If a merchant’s terminal breaks, I can pay another way. If my card program breaks, I cannot route around it; my funds stay inside it. I am not a participant in the system; I am a line in someone else’s database.
3. Revocability: This matters most and is discussed least. Every intermediary reserves the right to close your account, freeze your balance or end the program for reasons it need not explain. In conventional banking, we accept that, because deposit insurance and decades of regulation sit behind it. Crypto card programs have neither. You are trusting a startup, its sponsor bank and that bank’s regulators to stay aligned.
The bucket doesn’t just leak. Someone else holds the handle.
The goal is not to eliminate cards. It is to eliminate the pooled balance. Money should sit in the buyer’s own wallet until purchase, then move directly to the merchant on a public ledger, settling in seconds. Nothing should be deposited in advance, and nothing should be held by anyone in between.
This works today, as I’ve observed across the industry. A Bitcoin Lightning payment for a coffee settles in about a second. Stablecoin transfers on Solana, Base or Stellar cost a fraction of a cent, and a merchant can receive dollar-denominated value without depending on any bank’s crypto policy.
There is, however, remaining friction to address: clumsy wallets, messy tax reporting and merchant software that has to support these rails. Those are product problems, and product problems generally get solved. Counterparty risk is not solved by better UX.
If you still choose to use a crypto card, ask for three things.
1. Self-Custody Until Payment: Fund the card at purchase, not the month before. Some programs support just-in-time funding from your own wallet.
2. Proof Over Promises: If a company cannot show you where the funds are, assume you have no reliable proof of custody.
3. An Exit You Control: before you deposit, know how you withdraw, how long it takes and whether that exit depends on the same company that might be having the bad day.
I recommend keeping assets in wallets your company controls and moving funds only when payment is due. Each third party adds a dependency, and a failure anywhere in the chain can block access to your money. Payment infrastructure should help you move funds while leaving you in control
Companies like Rain will probably be fine. The affected cardholders probably will be, too. But “probably” is not a standard this technology was supposed to leave us with.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
