---
title: "Are stablecoin cards safe? Peg, issuer, custody, and smart contract risks"
seoTitle: "Are stablecoin cards safe? The 5 risks to check"
description: "The five risks of a stablecoin card: peg, program failure, custody, smart contracts, and fraud, with the August 2026 incident and a safety checklist."
date: "2026-09-27"
category: "stablecoins"
author: "BlindPay Team"
faq:
  - q: "Are stablecoin cards safe to use?"
    a: "They can be, if you check five risks: the stablecoin's peg and reserves, the program's financial health, who holds the funds, the smart contracts behind the card, and account fraud. Use a licensed program, keep only spending money on the card, turn on freeze controls and limits, and remember balances are not bank deposits."
  - q: "Can I lose money on a stablecoin card?"
    a: "Yes. Losses can come from a stablecoin losing its peg, a program or custodian failing, a smart contract exploit, or fraud on your account. In August 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract; affected programs such as Tria and Avici said users would be refunded in full."
  - q: "Are crypto card balances insured like a bank account?"
    a: "No, not in the way bank deposits are. The FDIC states that deposit insurance does not apply to crypto assets and does not protect against the failure of non-bank entities such as crypto custodians or exchanges. Read your program's terms to see exactly where your balance is held."
  - q: "Is a self-custodial stablecoin card safer than a custodial one?"
    a: "It removes some risks and adds others. A self-custodial card keeps funds in a wallet you control, so a program failure does not freeze them, and self-custodial wallets were reported unaffected in the August 2026 Rain contract incident. But you carry key management and smart account risk yourself."
  - q: "How do I spot a crypto card scam?"
    a: "Be wary of cards that promise guaranteed yield, ask for an upfront fee before you get the card, skip identity checks entirely, or cannot name the licensed issuer behind the card. A real program names its issuing bank or e-money institution and the card network, and identifies cardholders."
---

Stablecoin cards are as safe as the weakest of five layers: the stablecoin's peg, the program's finances, the custody model, the smart contracts, and your own account security. None of these balances is a bank deposit. Most risk can be reduced with a licensed program, a small card balance, and spending controls turned on.

The question is not whether stablecoin cards are safe in general. It is which risks a specific card exposes you to and how much money you keep on it. This guide walks through each risk with a real example and ends with a checklist. For how the cards work, see [what a stablecoin-backed card is](/resources/more/what-is-a-stablecoin-backed-card).

**Key takeaways**

- A stablecoin card carries five distinct risks: peg and reserves, program or issuer failure, custody, smart contracts and infrastructure, and account fraud.
- In August 2026, unauthorized withdrawals hit card balances in a Rain-managed Solana contract. Tria reported 636 affected users and $431,945, with every affected user being refunded in full.
- Self-custodial wallets were reported unaffected by that incident, because they sat outside the affected contract.
- The [FDIC states](https://www.fdic.gov/news/fact-sheets/crypto-fact-sheet-7-28-22.html) that deposit insurance does not apply to crypto assets.
- Keep only spending money on a card, and turn on freeze controls, limits, and 3-D Secure.

## What are the risks of a stablecoin card?

There are five. Each sits in a different layer of the card, and each is reduced in a different way.

| Risk | What can go wrong | Who carries it | How to reduce it |
| --- | --- | --- | --- |
| Peg and reserves | The stablecoin trades below one dollar or reserves fall short | Holder of the stablecoin | Hold well-reported stablecoins; keep balances small |
| Program or issuer failure | The program manager, custodian, or partner stops operating | Cardholders with funds held by the program | Use licensed programs that segregate customer funds |
| Custody | Funds held by a third party are frozen, lost, or mismanaged | Cardholders in custodial programs | Know who holds your funds; consider self-custodial options |
| Smart contract and infrastructure | A bug or exploit in shared contracts drains balances | Everyone using the affected contracts | Prefer programs with audits, monitoring, and a reimbursement record |
| Account fraud | Stolen card details, phishing, or account takeover | Cardholder, then program under its policies | 3-D Secure, freeze controls, limits, strong login security |

**Custodial:** a third party holds the stablecoins on your behalf, and the card spends from its ledger.

**Self-custodial:** you hold the keys to the wallet, and the card spends from it under rules set in a smart contract.

## Can a stablecoin lose its peg while it sits on a card?

Yes. A stablecoin is only as stable as its reserves and the market's confidence in redemption. If it trades below one dollar, the card converts fewer dollars per token.

How much this matters depends on the funding model. A just-in-time card keeps the balance in stablecoins until purchase, so a depeg hits the whole balance. A prefunded card has already converted the money into fiat at load time, so only unloaded stablecoins are exposed. [Just-in-time vs prefunded stablecoin cards](/resources/more/just-in-time-vs-prefunded-stablecoin-cards) explains the two models.

Dollar stablecoins carry most card volume today. The [best stablecoin for card spending](/resources/more/best-stablecoin-for-card-spending) compares USDC, USDT, and euro stablecoins on reserves and regulation.

## What happens if the card program or issuer fails?

It depends on how funds are held. In a custodial program, your balance is a claim on the program or its custodian, and getting it back depends on how well customer funds were segregated.

That is why licensing and segregation are on every safety checklist. A licensed issuer or e-money institution has to follow rules on how customer money is held. A program that cannot name its issuing bank or licensed partner gives you nothing to check.

Deposit insurance does not fill the gap. The FDIC's [fact sheet on crypto companies](https://www.fdic.gov/news/fact-sheets/crypto-fact-sheet-7-28-22.html) (July 2022) says deposit insurance does not apply to crypto assets and does not protect against the default, insolvency, or bankruptcy of non-bank entities, including crypto custodians and exchanges.

## What did the August 2026 card contract incident show?

It showed that shared infrastructure creates shared risk. A single contract version used by several programs became a single point of failure.

On August 28, 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract. Rain described it as [a vulnerability](https://x.com/raincards/status/2093435073081053518) "impacting a small number of programs using an outdated version of our Solana contracts." Rain upgraded the contracts the same day and confirmed repayment the next day.

Two affected programs published numbers:

| Program | Affected users | Amount | Outcome |
| --- | --- | --- | --- |
| Tria | 636 | $431,945 | Every affected user being refunded in full (per [SpendNode](https://www.spendnode.io/blog/tria-rain-solana-card-vulnerability-636-users-refund-august-2026/), August 29, 2026) |
| Avici | 1,685 | $500,859 | Refunds processed in full with an extra 10% cashback (per [SpendNode](https://www.spendnode.io/blog/avici-solana-card-refunds-complete-10-percent-cashback-august-2026/), August 30, 2026) |

Self-custodial wallets were reported unaffected because they sat outside the affected contract. Rain had not published a full post-mortem at the time of writing, and not every program built on Rain was exposed.

Self-custodial cards have their own contract risk. Gnosis Pay reported an exploit of its Delay and Roles modules on June 1, 2026, and its [post-mortem](https://gnosispay.com/blog/post-mortem-gnosis-pay-vulnerability-exploit) says attackers extracted $1.5 million and that Gnosis absorbed the losses and restored all funds to users. [Custodial vs self-custodial stablecoin cards](/resources/more/custodial-vs-self-custodial-stablecoin-cards) compares how each model fails.

## How does account fraud happen on a stablecoin card?

Mostly the same way it happens on any card: stolen card numbers, phishing, and account takeover. The card rails are the same, so the same protections apply.

What changes is the recovery path. Card purchases go through network dispute rules, but a stablecoin transfer out of your wallet is final once confirmed. If an attacker gets into the account that funds the card, they may move stablecoins out directly instead of using the card. [Are stablecoin payments reversible?](/resources/more/are-stablecoin-payments-reversible) explains why onchain transfers cannot be pulled back.

Watch for these scam signals:

- Guaranteed yield or rewards that sound too good.
- An upfront fee before the card is issued.
- No identity checks at all. Card rails require cardholder identification even when the wallet is permissionless, as [neobankbeat notes](https://www.neobankbeat.com/blog/stablecoin-cards-explained).
- No named issuing bank, e-money institution, or card network.

## What should you check before trusting a stablecoin card?

Run through ten checks. A program that fails several of them is not worth a large balance.

1. **License.** The issuer or program names a licensed bank or e-money institution, and you can find it on the regulator's public register.
2. **Segregation.** The terms say customer funds are segregated from the company's own money.
3. **Custody model.** You know whether the program or you hold the stablecoins.
4. **Contract security.** For onchain programs, audits are public and the program has a record of handling incidents.
5. **Freeze controls.** You can freeze and unfreeze the card instantly in the app.
6. **3-D Secure.** Online purchases need an extra confirmation step.
7. **Limits.** You can set daily and per-transaction limits.
8. **Login security.** The account supports strong two-factor authentication.
9. **Small balance.** You keep only near-term spending money on the card.
10. **Exit path.** You know how to move money out to a bank account if the card stops working.

## Where does BlindPay fit?

The tenth check, an exit path, is where BlindPay sits. A card is a spending interface. Getting money out to a bank account needs a payout rail.

BlindPay converts USDC or USDT into local currency over Pix, SPEI, ACH, RTP, SEPA, and SWIFT (POBO/COBO), with KYC, KYB, and sanctions screening built into the API flow. For payouts from wallets the customer controls, BlindPay works as a non-custodial payment processor: the customer authorizes the exact amount and BlindPay executes that single transaction, so the stablecoins stay in the customer's wallet until a payout is authorized. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet or the sending wallet; on Pix and other non-USD local rails the refund is automatic, while USD payouts and payouts whose review times out are refunded after an operator review. Managed wallets, offered in beta, are custodial when a customer chooses that path.

For card programs, that means the payout leg does not add another pooled balance to the risk list. [Non-custodial payments explained](/resources/more/non-custodial-payments-explained) covers the model in more detail.

## How to use a stablecoin card more safely today

Pick a licensed program, keep a small balance, and turn on every control the app offers. Then make sure you can reach a bank account without the card.

If you run a card program and want a payout path that keeps funds under your customers' control, test it on a free BlindPay development instance with the [payout quickstart](/docs/quickstart-payout). For the layers behind every card, read [what stablecoin card issuing is](/resources/more/what-is-stablecoin-card-issuing). For the business-side view of the same risks, see [are stablecoin payments safe](/resources/more/are-stablecoin-payments-safe).

## Sources

- FDIC, [What the public needs to know about FDIC deposit insurance and crypto companies](https://www.fdic.gov/news/fact-sheets/crypto-fact-sheet-7-28-22.html), July 28, 2022
- Rain, [statement on the Solana contract vulnerability](https://x.com/raincards/status/2093435073081053518), August 2026
- SpendNode, [Tria details Rain card vulnerability: 636 users, $431,945 refunded](https://www.spendnode.io/blog/tria-rain-solana-card-vulnerability-636-users-refund-august-2026/), August 29, 2026
- SpendNode, [Avici completes refunds with 10% cashback](https://www.spendnode.io/blog/avici-solana-card-refunds-complete-10-percent-cashback-august-2026/), August 30, 2026
- Gnosis Pay, [Post-mortem: Gnosis Pay vulnerability exploit](https://gnosispay.com/blog/post-mortem-gnosis-pay-vulnerability-exploit)
- neobankbeat, [Stablecoin cards explained](https://www.neobankbeat.com/blog/stablecoin-cards-explained), November 18, 2025