Crypto Cards: Where Your Card Balance Really Sits and What the August 28 Solana Exploit Reveals About It

When you pay with a crypto card, the money backing that card frequently does not sit in your own wallet. It sits in a separate container operated by the card platform and filled by you when you top up. On August 28, 2026 an attack on exactly such a container showed what that means when things go wrong: users' self-custodied wallets were left untouched, and the loaded card balance was gone.

The provider concerned is not available in Germany. The construction behind it, however, is. This piece places the incident in context, explains the terms and shows you how to tell which custody model your own card uses and who would be responsible in the event of a loss.

What happened in Avici's Solana card contract on August 28, 2026

Avici is a so-called neobank on the Solana blockchain: an app that attaches a Visa card to an on-chain account of its own. On August 28, 2026 the provider disclosed that there was a problem with card payouts. According to the reconstruction by crypto.news, the first malicious transaction occurred at 16:49:48 UTC, and reporting began in the early evening.

On the provider's account, what was affected was neither the Solana network nor the users' app wallet, but a single smart contract in which the backing for the cards is held. Anyone who left their funds in the app without loading them onto the card stood outside the attack. Anyone who had topped up stood inside it.

How the attack worked technically

On the account given by Cryptopolitan, the attacker exploited the payout logic of the program written in Rust by calling the functions SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset one after another. The middle step is the decisive one: with it the attacker entered himself as an authorised administrator of the collateral and could then withdraw what had been deposited through the regular route.

The episode was not a single grab. According to the breakdown Avici published later, the attack series comprised 14,672 transactions, of which 2,344 failed. That points to an automated script working through the contract systematically over hours rather than to a one-off strike.

Card balance contract: what it is and why it is not your wallet

A card balance contract is a standalone program on a blockchain into which you transfer funds so that a payment card can draw on them. As soon as you top up, the money leaves your wallet and sits in that contract until a card payment is settled or you pull it back.

The difference from a wallet is practical rather than theoretical. Your wallet is protected by a key only you hold. The card contract has an access logic of its own, usually with roles for the operator so that settlement works at all. Whoever defeats that role management reaches the balances of every user without knowing a single private key.

That is exactly what happened at Avici. The app's self-custodied Solana and EVM wallets were left untouched according to the provider. What was attacked was solely the separate contract into which users had transferred funds for the card. The widespread notion that a self-custodial product is automatically self-custodial as a whole does not hold at this point.

How large the damage was: why $500,000 and $1.07 million can both be right

Two orders of magnitude are circulating about the scale, and both rest on a traceable basis. On the day of the incident crypto.news counted an outflow of 10,005.03 SOL plus around $11,600 in USDC and USDT, together roughly $1.07 million at the price of the time. Avici itself named 1,685 affected users and $500,859.22 in card balances after its internal reconciliation.

The range of roughly $0.5 million to $1.07 million resolves once you look at the reference quantity. The higher figure measures what flowed out of the contract in assets. The lower one measures how much of that could be assigned to individual customer accounts as card balance. Both figures come from different ways of counting, and neither is the "correct" one in the sense of the other.

For you as a reader the lesson matters more than the exact sum: in the first hours of an incident like this, on-chain estimates and the provider's later reconciliation stand side by side, and they rarely coincide. Anyone making decisions in that phase should know which of the two figures they are looking at.

Rain as card issuer: the role the infrastructure in the background plays

The name on the card is the app's. Issuing and technical operation are as a rule handled by a specialised card issuer in the background. At Avici that is the firm Rain, which supplies card programmes for companies and maintains contracts of its own on several blockchains for the purpose.

According to the companies involved, Rain located the fault itself and traced it to an outdated version of its Solana contracts, used besides Avici by a small number of other programmes. The company says all deployments still running on that version were subsequently updated and external forensic specialists brought in. Which other programmes were affected, and whether damage arose there, has not been named publicly.

Avici has undertaken to reimburse all affected card balances in full and says it has filed a report with the FBI's Internet Crime Complaint Center. Whether and when reimbursements have actually been made cannot be verified from outside; the undertaking is an announcement by the company rather than an accomplished fact.

Why Jupiter halted card payouts as a precaution

On the same day the card programme of the Solana trading platform Jupiter also briefly paused payouts of card balances. The platform explained this as a precautionary measure while its card partner completed security checks of its own, and stated that its own users' accounts and funds had at no point been affected. Payouts then resumed as normal.

This episode is more instructive than it first appears. The brief halt shows that a fault in a shared contract version reaches several card programmes at once, including ones from which nothing ultimately flows out. The card in your hand can come from a provider whose software you never chose.

What a precautionary payout halt means for you

Such a halt amounts in effect to a temporary block on your card balance. The money is not lost, but it is unavailable for the duration of the check. Anyone parking a whole month's spending on a crypto card notices the difference from a current account in exactly this situation.

Which crypto cards use this model and where Rain issues at all

For German readers the availability question is the first filter, and it comes out clearly for the two programmes named. Avici's documentation lists 47 territories in which the card can be used, among them countries in Latin America, Africa and Asia and individual US states. Europe, the European Economic Area and Germany appear in neither the permitted nor the prohibited list. The Jupiter card, issued by Rain or by DCS depending on country of residence, likewise does not list the EEA among its supported regions.

The model itself is nevertheless available in Germany. The card from ether.fi, for instance, is also issued through Rain, holds the balance in a smart contract vault controlled by the user, and settles on the Ethereum layer 2 Scroll. The provider's help page lists twenty unsupported countries, among them Estonia, Finland, the Netherlands and Hungary; Germany is not on it. Because this programme does not settle on Solana, it falls outside the contract version at issue in the Avici case.

Anyone looking around this product group finds cards with quite different mechanics side by side. Which models exist and how fees and cashback differ is set out in the overview of crypto credit cards. The custody question is only one of several there, but it is the one that decides responsibility when something goes wrong.

MiCA and the e-money licence: which rules apply to a card balance in Europe

In the EU a payment card with a loaded balance is normally an e-money product. The issuer needs authorisation as an e-money institution for it, must separate customer funds from its own assets and hold them at a bank or in safe investments. Where crypto enters the picture, authorisation as a crypto-asset service provider has been added since the MiCA transition period ended on July 1, 2026.

The difference from deposit protection matters: segregated custody means that customer funds do not fall into the estate if the provider becomes insolvent. It does not mean that a state guarantee scheme steps in for losses, as it does for bank deposits up to 100,000 euros. Advertising for payment cards regularly conflates the two.

If your card balance sits in an on-chain contract instead, this framework does not apply in that form. There is then no custodied customer money at an institution, but assets in a program whose security depends on the code and on its role management. Reimbursement in that case is a matter of goodwill and of the provider's contractual undertaking, as the Avici case shows, and not a matter of supervisory law.

Custodied account or on-chain contract: the two models at a glance

Under the first model you top up a card, your crypto is sold either at top-up or at payment, and what sits on the card is electronic money at a licensed issuer. The provider keeps an account for you, the supervisor watches over the separation of customer funds, and in a dispute you have a named contractual partner holding authorisation.

Under the second model you transfer crypto into a contract that serves as collateral or as the balance for the card. The appeal lies in keeping control for longer and not having to sell assets in order to be able to pay. The price lies in the security of that contract becoming your risk, regardless of how well you look after your own keys.

Hybrid forms exist. Some providers hold the balance in fiat at an institution and additionally let you post crypto as collateral. Others convert only at the moment of payment. Which variant applies is stated in the terms, and reading those repays the effort more than the product description on the home page.

Tax when paying by crypto card: why every payment can be a disposal

Regardless of the custody model, paying with crypto in Germany has a tax dimension that many discover only at the tax return. If crypto is exchanged into euros at the card payment or at top-up, that is a disposal in the sense of private assets. Whether a taxable gain results depends on the holding period, the acquisition costs and the exemption threshold.

In practice that means a card converting a small amount at every purchase generates many individual events that want documenting. Anyone not recording them continuously faces a reconstruction from bank statements and blockchain data at the end of the year. Models in which you pay against posted collateral instead of selling behave differently for tax purposes; here an assessment of the individual case repays the effort, because it turns on the specific contractual arrangement.

Checked in ten minutes: how to find out which model your card uses

You answer the following questions for your own card from the provider's documents rather than from memory.

First: who issues the card? The terms name an institution with a registered office and an authorisation. If an EEA e-money institution is named there, that points to the first model. If an infrastructure provider without any stated authorisation is named, read on.

Second: what happens when you top up? If your crypto is converted into euros or dollars and carried as a balance, e-money is involved. If it stays as crypto and is described as collateral, you are working with an on-chain contract.

Third: do the terms name a contract with an address? Providers of the second model give the contract address or a vault. That is a reliable identifying mark.

Fourth: how is reimbursement handled when things go wrong? Search the terms for the words liability, reimbursement and exclusion. A provider expressly excluding losses from faults in smart contracts is telling you where your risk lies.

Fifth: how much is on the card at all? A card balance is cash in your jacket pocket and not a portfolio. Loading only the next few weeks' needs limits the possible damage to an amount you can absorb.

If this check brings you up against approvals and signatures you are asked to confirm, read carefully first what you are approving. How to recognise an abusive approval is set out at length in our guide to wallet drainers and signature approvals.

Crypto cards and card balances: what to take away

The August 28 incident does not concern you directly as a German card user, because the two programmes named are not available here. The construction that made the damage possible in the first place, however, is also found in cards you can obtain in this country. Three steps take you further:

1. Determine your card model. Take your card's terms and answer the five questions from the previous section. If you find in the process that the card does not suit the way you use it, the alternatives are in the overview of crypto credit cards.
2. Separate balance from custody. Hold on the card only what you will spend in the coming weeks, and leave the rest where you control the keys. Which wallet is suited to that is shown by the comparison of software wallets.
3. Record payments for tax as you go. Capture top-ups and conversions continuously rather than once a year. Which tools handle that automatically is set out in the overview of crypto tax tools and portfolio trackers.

(As of August 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)