[{"data":1,"prerenderedAt":716},["ShallowReactive",2],{"content-\u002Fresources\u002Fmore\u002Fare-stablecoin-cards-safe":3,"resources-category-are-stablecoin-cards-safe":551},{"id":4,"title":5,"authors":6,"body":7,"categories":6,"category":521,"categoryType":6,"compare":6,"contributors":6,"date":522,"description":523,"extension":524,"faq":525,"howto":6,"isBlog":541,"isChangelog":541,"meta":542,"navigation":544,"path":545,"pillar":541,"products":6,"rawbody":546,"role":6,"seo":547,"seoTitle":548,"stem":549,"thumbnail":6,"updated":6,"__hash__":550},"content\u002Fresources\u002Fmore\u002Fare-stablecoin-cards-safe.md","Are stablecoin cards safe? Peg, issuer, custody, and smart contract risks",null,{"type":8,"value":9,"toc":508},"minimark",[10,14,23,29,55,60,63,159,165,171,175,178,186,194,198,201,204,212,216,219,228,231,290,293,307,311,314,322,325,344,348,351,414,418,421,424,432,436,439,456,460],[11,12,13],"p",{},"Stablecoin cards are as safe as the weakest of five layers: the stablecoin's peg, the program's finances, the custody model, the smart contracts, and your own account security. None of these balances is a bank deposit. Most risk can be reduced with a licensed program, a small card balance, and spending controls turned on.",[11,15,16,17,22],{},"The question is not whether stablecoin cards are safe in general. It is which risks a specific card exposes you to and how much money you keep on it. This guide walks through each risk with a real example and ends with a checklist. For how the cards work, see ",[18,19,21],"a",{"href":20},"\u002Fresources\u002Fmore\u002Fwhat-is-a-stablecoin-backed-card","what a stablecoin-backed card is",".",[11,24,25],{},[26,27,28],"strong",{},"Key takeaways",[30,31,32,36,39,42,52],"ul",{},[33,34,35],"li",{},"A stablecoin card carries five distinct risks: peg and reserves, program or issuer failure, custody, smart contracts and infrastructure, and account fraud.",[33,37,38],{},"In August 2026, unauthorized withdrawals hit card balances in a Rain-managed Solana contract. Tria reported 636 affected users and $431,945, with every affected user being refunded in full.",[33,40,41],{},"Self-custodial wallets were reported unaffected by that incident, because they sat outside the affected contract.",[33,43,44,45,51],{},"The ",[18,46,50],{"href":47,"rel":48},"https:\u002F\u002Fwww.fdic.gov\u002Fnews\u002Ffact-sheets\u002Fcrypto-fact-sheet-7-28-22.html",[49],"nofollow","FDIC states"," that deposit insurance does not apply to crypto assets.",[33,53,54],{},"Keep only spending money on a card, and turn on freeze controls, limits, and 3-D Secure.",[56,57,59],"h2",{"id":58},"what-are-the-risks-of-a-stablecoin-card","What are the risks of a stablecoin card?",[11,61,62],{},"There are five. Each sits in a different layer of the card, and each is reduced in a different way.",[64,65,66,85],"table",{},[67,68,69],"thead",{},[70,71,72,76,79,82],"tr",{},[73,74,75],"th",{},"Risk",[73,77,78],{},"What can go wrong",[73,80,81],{},"Who carries it",[73,83,84],{},"How to reduce it",[86,87,88,103,117,131,145],"tbody",{},[70,89,90,94,97,100],{},[91,92,93],"td",{},"Peg and reserves",[91,95,96],{},"The stablecoin trades below one dollar or reserves fall short",[91,98,99],{},"Holder of the stablecoin",[91,101,102],{},"Hold well-reported stablecoins; keep balances small",[70,104,105,108,111,114],{},[91,106,107],{},"Program or issuer failure",[91,109,110],{},"The program manager, custodian, or partner stops operating",[91,112,113],{},"Cardholders with funds held by the program",[91,115,116],{},"Use licensed programs that segregate customer funds",[70,118,119,122,125,128],{},[91,120,121],{},"Custody",[91,123,124],{},"Funds held by a third party are frozen, lost, or mismanaged",[91,126,127],{},"Cardholders in custodial programs",[91,129,130],{},"Know who holds your funds; consider self-custodial options",[70,132,133,136,139,142],{},[91,134,135],{},"Smart contract and infrastructure",[91,137,138],{},"A bug or exploit in shared contracts drains balances",[91,140,141],{},"Everyone using the affected contracts",[91,143,144],{},"Prefer programs with audits, monitoring, and a reimbursement record",[70,146,147,150,153,156],{},[91,148,149],{},"Account fraud",[91,151,152],{},"Stolen card details, phishing, or account takeover",[91,154,155],{},"Cardholder, then program under its policies",[91,157,158],{},"3-D Secure, freeze controls, limits, strong login security",[11,160,161,164],{},[26,162,163],{},"Custodial:"," a third party holds the stablecoins on your behalf, and the card spends from its ledger.",[11,166,167,170],{},[26,168,169],{},"Self-custodial:"," you hold the keys to the wallet, and the card spends from it under rules set in a smart contract.",[56,172,174],{"id":173},"can-a-stablecoin-lose-its-peg-while-it-sits-on-a-card","Can a stablecoin lose its peg while it sits on a card?",[11,176,177],{},"Yes. A stablecoin is only as stable as its reserves and the market's confidence in redemption. If it trades below one dollar, the card converts fewer dollars per token.",[11,179,180,181,185],{},"How much this matters depends on the funding model. A just-in-time card keeps the balance in stablecoins until purchase, so a depeg hits the whole balance. A prefunded card has already converted the money into fiat at load time, so only unloaded stablecoins are exposed. ",[18,182,184],{"href":183},"\u002Fresources\u002Fmore\u002Fjust-in-time-vs-prefunded-stablecoin-cards","Just-in-time vs prefunded stablecoin cards"," explains the two models.",[11,187,188,189,193],{},"Dollar stablecoins carry most card volume today. The ",[18,190,192],{"href":191},"\u002Fresources\u002Fmore\u002Fbest-stablecoin-for-card-spending","best stablecoin for card spending"," compares USDC, USDT, and euro stablecoins on reserves and regulation.",[56,195,197],{"id":196},"what-happens-if-the-card-program-or-issuer-fails","What happens if the card program or issuer fails?",[11,199,200],{},"It depends on how funds are held. In a custodial program, your balance is a claim on the program or its custodian, and getting it back depends on how well customer funds were segregated.",[11,202,203],{},"That is why licensing and segregation are on every safety checklist. A licensed issuer or e-money institution has to follow rules on how customer money is held. A program that cannot name its issuing bank or licensed partner gives you nothing to check.",[11,205,206,207,211],{},"Deposit insurance does not fill the gap. The FDIC's ",[18,208,210],{"href":47,"rel":209},[49],"fact sheet on crypto companies"," (July 2022) says deposit insurance does not apply to crypto assets and does not protect against the default, insolvency, or bankruptcy of non-bank entities, including crypto custodians and exchanges.",[56,213,215],{"id":214},"what-did-the-august-2026-card-contract-incident-show","What did the August 2026 card contract incident show?",[11,217,218],{},"It showed that shared infrastructure creates shared risk. A single contract version used by several programs became a single point of failure.",[11,220,221,222,227],{},"On August 28, 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract. Rain described it as ",[18,223,226],{"href":224,"rel":225},"https:\u002F\u002Fx.com\u002Fraincards\u002Fstatus\u002F2093435073081053518",[49],"a vulnerability"," \"impacting a small number of programs using an outdated version of our Solana contracts.\" Rain upgraded the contracts the same day and confirmed repayment the next day.",[11,229,230],{},"Two affected programs published numbers:",[64,232,233,249],{},[67,234,235],{},[70,236,237,240,243,246],{},[73,238,239],{},"Program",[73,241,242],{},"Affected users",[73,244,245],{},"Amount",[73,247,248],{},"Outcome",[86,250,251,271],{},[70,252,253,256,259,262],{},[91,254,255],{},"Tria",[91,257,258],{},"636",[91,260,261],{},"$431,945",[91,263,264,265,270],{},"Every affected user being refunded in full (per ",[18,266,269],{"href":267,"rel":268},"https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Ftria-rain-solana-card-vulnerability-636-users-refund-august-2026\u002F",[49],"SpendNode",", August 29, 2026)",[70,272,273,276,279,282],{},[91,274,275],{},"Avici",[91,277,278],{},"1,685",[91,280,281],{},"$500,859",[91,283,284,285,289],{},"Refunds processed in full with an extra 10% cashback (per ",[18,286,269],{"href":287,"rel":288},"https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Favici-solana-card-refunds-complete-10-percent-cashback-august-2026\u002F",[49],", August 30, 2026)",[11,291,292],{},"Self-custodial wallets were reported unaffected because they sat outside the affected contract. Rain had not published a full post-mortem at the time of writing, and not every program built on Rain was exposed.",[11,294,295,296,301,302,306],{},"Self-custodial cards have their own contract risk. Gnosis Pay reported an exploit of its Delay and Roles modules on June 1, 2026, and its ",[18,297,300],{"href":298,"rel":299},"https:\u002F\u002Fgnosispay.com\u002Fblog\u002Fpost-mortem-gnosis-pay-vulnerability-exploit",[49],"post-mortem"," says attackers extracted $1.5 million and that Gnosis absorbed the losses and restored all funds to users. ",[18,303,305],{"href":304},"\u002Fresources\u002Fmore\u002Fcustodial-vs-self-custodial-stablecoin-cards","Custodial vs self-custodial stablecoin cards"," compares how each model fails.",[56,308,310],{"id":309},"how-does-account-fraud-happen-on-a-stablecoin-card","How does account fraud happen on a stablecoin card?",[11,312,313],{},"Mostly the same way it happens on any card: stolen card numbers, phishing, and account takeover. The card rails are the same, so the same protections apply.",[11,315,316,317,321],{},"What changes is the recovery path. Card purchases go through network dispute rules, but a stablecoin transfer out of your wallet is final once confirmed. If an attacker gets into the account that funds the card, they may move stablecoins out directly instead of using the card. ",[18,318,320],{"href":319},"\u002Fresources\u002Fmore\u002Fare-stablecoin-payments-reversible","Are stablecoin payments reversible?"," explains why onchain transfers cannot be pulled back.",[11,323,324],{},"Watch for these scam signals:",[30,326,327,330,333,341],{},[33,328,329],{},"Guaranteed yield or rewards that sound too good.",[33,331,332],{},"An upfront fee before the card is issued.",[33,334,335,336,22],{},"No identity checks at all. Card rails require cardholder identification even when the wallet is permissionless, as ",[18,337,340],{"href":338,"rel":339},"https:\u002F\u002Fwww.neobankbeat.com\u002Fblog\u002Fstablecoin-cards-explained",[49],"neobankbeat notes",[33,342,343],{},"No named issuing bank, e-money institution, or card network.",[56,345,347],{"id":346},"what-should-you-check-before-trusting-a-stablecoin-card","What should you check before trusting a stablecoin card?",[11,349,350],{},"Run through ten checks. A program that fails several of them is not worth a large balance.",[352,353,354,360,366,372,378,384,390,396,402,408],"ol",{},[33,355,356,359],{},[26,357,358],{},"License."," The issuer or program names a licensed bank or e-money institution, and you can find it on the regulator's public register.",[33,361,362,365],{},[26,363,364],{},"Segregation."," The terms say customer funds are segregated from the company's own money.",[33,367,368,371],{},[26,369,370],{},"Custody model."," You know whether the program or you hold the stablecoins.",[33,373,374,377],{},[26,375,376],{},"Contract security."," For onchain programs, audits are public and the program has a record of handling incidents.",[33,379,380,383],{},[26,381,382],{},"Freeze controls."," You can freeze and unfreeze the card instantly in the app.",[33,385,386,389],{},[26,387,388],{},"3-D Secure."," Online purchases need an extra confirmation step.",[33,391,392,395],{},[26,393,394],{},"Limits."," You can set daily and per-transaction limits.",[33,397,398,401],{},[26,399,400],{},"Login security."," The account supports strong two-factor authentication.",[33,403,404,407],{},[26,405,406],{},"Small balance."," You keep only near-term spending money on the card.",[33,409,410,413],{},[26,411,412],{},"Exit path."," You know how to move money out to a bank account if the card stops working.",[56,415,417],{"id":416},"where-does-blindpay-fit","Where does BlindPay fit?",[11,419,420],{},"The tenth check, an exit path, is where BlindPay sits. A card is a spending interface. Getting money out to a bank account needs a payout rail.",[11,422,423],{},"BlindPay converts USDC or USDT into local currency over Pix, SPEI, ACH, RTP, SEPA, and SWIFT (POBO\u002FCOBO), with KYC, KYB, and sanctions screening built into the API flow. For payouts from wallets the customer controls, BlindPay works as a non-custodial payment processor: the customer authorizes the exact amount and BlindPay executes that single transaction, so the stablecoins stay in the customer's wallet until a payout is authorized. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet or the sending wallet; on Pix and other non-USD local rails the refund is automatic, while USD payouts and payouts whose review times out are refunded after an operator review. Managed wallets, offered in beta, are custodial when a customer chooses that path.",[11,425,426,427,431],{},"For card programs, that means the payout leg does not add another pooled balance to the risk list. ",[18,428,430],{"href":429},"\u002Fresources\u002Fmore\u002Fnon-custodial-payments-explained","Non-custodial payments explained"," covers the model in more detail.",[56,433,435],{"id":434},"how-to-use-a-stablecoin-card-more-safely-today","How to use a stablecoin card more safely today",[11,437,438],{},"Pick a licensed program, keep a small balance, and turn on every control the app offers. Then make sure you can reach a bank account without the card.",[11,440,441,442,446,447,451,452,22],{},"If you run a card program and want a payout path that keeps funds under your customers' control, test it on a free BlindPay development instance with the ",[18,443,445],{"href":444},"\u002Fdocs\u002Fquickstart-payout","payout quickstart",". For the layers behind every card, read ",[18,448,450],{"href":449},"\u002Fresources\u002Fmore\u002Fwhat-is-stablecoin-card-issuing","what stablecoin card issuing is",". For the business-side view of the same risks, see ",[18,453,455],{"href":454},"\u002Fresources\u002Fmore\u002Fare-stablecoin-payments-safe","are stablecoin payments safe",[56,457,459],{"id":458},"sources","Sources",[30,461,462,470,478,486,493,500],{},[33,463,464,465,469],{},"FDIC, ",[18,466,468],{"href":47,"rel":467},[49],"What the public needs to know about FDIC deposit insurance and crypto companies",", July 28, 2022",[33,471,472,473,477],{},"Rain, ",[18,474,476],{"href":224,"rel":475},[49],"statement on the Solana contract vulnerability",", August 2026",[33,479,480,481,485],{},"SpendNode, ",[18,482,484],{"href":267,"rel":483},[49],"Tria details Rain card vulnerability: 636 users, $431,945 refunded",", August 29, 2026",[33,487,480,488,492],{},[18,489,491],{"href":287,"rel":490},[49],"Avici completes refunds with 10% cashback",", August 30, 2026",[33,494,495,496],{},"Gnosis Pay, ",[18,497,499],{"href":298,"rel":498},[49],"Post-mortem: Gnosis Pay vulnerability exploit",[33,501,502,503,507],{},"neobankbeat, ",[18,504,506],{"href":338,"rel":505},[49],"Stablecoin cards explained",", November 18, 2025",{"title":509,"searchDepth":510,"depth":510,"links":511},"",2,[512,513,514,515,516,517,518,519,520],{"id":58,"depth":510,"text":59},{"id":173,"depth":510,"text":174},{"id":196,"depth":510,"text":197},{"id":214,"depth":510,"text":215},{"id":309,"depth":510,"text":310},{"id":346,"depth":510,"text":347},{"id":416,"depth":510,"text":417},{"id":434,"depth":510,"text":435},{"id":458,"depth":510,"text":459},"stablecoins","2026-09-27","The five risks of a stablecoin card: peg, program failure, custody, smart contracts, and fraud, with the August 2026 incident and a safety checklist.","md",[526,529,532,535,538],{"q":527,"a":528},"Are stablecoin cards safe to use?","They can be, if you check five risks: the stablecoin's peg and reserves, the program's financial health, who holds the funds, the smart contracts behind the card, and account fraud. Use a licensed program, keep only spending money on the card, turn on freeze controls and limits, and remember balances are not bank deposits.",{"q":530,"a":531},"Can I lose money on a stablecoin card?","Yes. Losses can come from a stablecoin losing its peg, a program or custodian failing, a smart contract exploit, or fraud on your account. In August 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract; affected programs such as Tria and Avici said users would be refunded in full.",{"q":533,"a":534},"Are crypto card balances insured like a bank account?","No, not in the way bank deposits are. The FDIC states that deposit insurance does not apply to crypto assets and does not protect against the failure of non-bank entities such as crypto custodians or exchanges. Read your program's terms to see exactly where your balance is held.",{"q":536,"a":537},"Is a self-custodial stablecoin card safer than a custodial one?","It removes some risks and adds others. A self-custodial card keeps funds in a wallet you control, so a program failure does not freeze them, and self-custodial wallets were reported unaffected in the August 2026 Rain contract incident. But you carry key management and smart account risk yourself.",{"q":539,"a":540},"How do I spot a crypto card scam?","Be wary of cards that promise guaranteed yield, ask for an upfront fee before you get the card, skip identity checks entirely, or cannot name the licensed issuer behind the card. A real program names its issuing bank or e-money institution and the card network, and identifies cardholders.",false,{"author":543},"BlindPay Team",true,"\u002Fresources\u002Fmore\u002Fare-stablecoin-cards-safe","---\ntitle: \"Are stablecoin cards safe? Peg, issuer, custody, and smart contract risks\"\nseoTitle: \"Are stablecoin cards safe? The 5 risks to check\"\ndescription: \"The five risks of a stablecoin card: peg, program failure, custody, smart contracts, and fraud, with the August 2026 incident and a safety checklist.\"\ndate: \"2026-09-27\"\ncategory: \"stablecoins\"\nauthor: \"BlindPay Team\"\nfaq:\n  - q: \"Are stablecoin cards safe to use?\"\n    a: \"They can be, if you check five risks: the stablecoin's peg and reserves, the program's financial health, who holds the funds, the smart contracts behind the card, and account fraud. Use a licensed program, keep only spending money on the card, turn on freeze controls and limits, and remember balances are not bank deposits.\"\n  - q: \"Can I lose money on a stablecoin card?\"\n    a: \"Yes. Losses can come from a stablecoin losing its peg, a program or custodian failing, a smart contract exploit, or fraud on your account. In August 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract; affected programs such as Tria and Avici said users would be refunded in full.\"\n  - q: \"Are crypto card balances insured like a bank account?\"\n    a: \"No, not in the way bank deposits are. The FDIC states that deposit insurance does not apply to crypto assets and does not protect against the failure of non-bank entities such as crypto custodians or exchanges. Read your program's terms to see exactly where your balance is held.\"\n  - q: \"Is a self-custodial stablecoin card safer than a custodial one?\"\n    a: \"It removes some risks and adds others. A self-custodial card keeps funds in a wallet you control, so a program failure does not freeze them, and self-custodial wallets were reported unaffected in the August 2026 Rain contract incident. But you carry key management and smart account risk yourself.\"\n  - q: \"How do I spot a crypto card scam?\"\n    a: \"Be wary of cards that promise guaranteed yield, ask for an upfront fee before you get the card, skip identity checks entirely, or cannot name the licensed issuer behind the card. A real program names its issuing bank or e-money institution and the card network, and identifies cardholders.\"\n---\n\nStablecoin cards are as safe as the weakest of five layers: the stablecoin's peg, the program's finances, the custody model, the smart contracts, and your own account security. None of these balances is a bank deposit. Most risk can be reduced with a licensed program, a small card balance, and spending controls turned on.\n\nThe question is not whether stablecoin cards are safe in general. It is which risks a specific card exposes you to and how much money you keep on it. This guide walks through each risk with a real example and ends with a checklist. For how the cards work, see [what a stablecoin-backed card is](\u002Fresources\u002Fmore\u002Fwhat-is-a-stablecoin-backed-card).\n\n**Key takeaways**\n\n- A stablecoin card carries five distinct risks: peg and reserves, program or issuer failure, custody, smart contracts and infrastructure, and account fraud.\n- In August 2026, unauthorized withdrawals hit card balances in a Rain-managed Solana contract. Tria reported 636 affected users and $431,945, with every affected user being refunded in full.\n- Self-custodial wallets were reported unaffected by that incident, because they sat outside the affected contract.\n- The [FDIC states](https:\u002F\u002Fwww.fdic.gov\u002Fnews\u002Ffact-sheets\u002Fcrypto-fact-sheet-7-28-22.html) that deposit insurance does not apply to crypto assets.\n- Keep only spending money on a card, and turn on freeze controls, limits, and 3-D Secure.\n\n## What are the risks of a stablecoin card?\n\nThere are five. Each sits in a different layer of the card, and each is reduced in a different way.\n\n| Risk | What can go wrong | Who carries it | How to reduce it |\n| --- | --- | --- | --- |\n| Peg and reserves | The stablecoin trades below one dollar or reserves fall short | Holder of the stablecoin | Hold well-reported stablecoins; keep balances small |\n| Program or issuer failure | The program manager, custodian, or partner stops operating | Cardholders with funds held by the program | Use licensed programs that segregate customer funds |\n| Custody | Funds held by a third party are frozen, lost, or mismanaged | Cardholders in custodial programs | Know who holds your funds; consider self-custodial options |\n| Smart contract and infrastructure | A bug or exploit in shared contracts drains balances | Everyone using the affected contracts | Prefer programs with audits, monitoring, and a reimbursement record |\n| Account fraud | Stolen card details, phishing, or account takeover | Cardholder, then program under its policies | 3-D Secure, freeze controls, limits, strong login security |\n\n**Custodial:** a third party holds the stablecoins on your behalf, and the card spends from its ledger.\n\n**Self-custodial:** you hold the keys to the wallet, and the card spends from it under rules set in a smart contract.\n\n## Can a stablecoin lose its peg while it sits on a card?\n\nYes. A stablecoin is only as stable as its reserves and the market's confidence in redemption. If it trades below one dollar, the card converts fewer dollars per token.\n\nHow much this matters depends on the funding model. A just-in-time card keeps the balance in stablecoins until purchase, so a depeg hits the whole balance. A prefunded card has already converted the money into fiat at load time, so only unloaded stablecoins are exposed. [Just-in-time vs prefunded stablecoin cards](\u002Fresources\u002Fmore\u002Fjust-in-time-vs-prefunded-stablecoin-cards) explains the two models.\n\nDollar stablecoins carry most card volume today. The [best stablecoin for card spending](\u002Fresources\u002Fmore\u002Fbest-stablecoin-for-card-spending) compares USDC, USDT, and euro stablecoins on reserves and regulation.\n\n## What happens if the card program or issuer fails?\n\nIt depends on how funds are held. In a custodial program, your balance is a claim on the program or its custodian, and getting it back depends on how well customer funds were segregated.\n\nThat is why licensing and segregation are on every safety checklist. A licensed issuer or e-money institution has to follow rules on how customer money is held. A program that cannot name its issuing bank or licensed partner gives you nothing to check.\n\nDeposit insurance does not fill the gap. The FDIC's [fact sheet on crypto companies](https:\u002F\u002Fwww.fdic.gov\u002Fnews\u002Ffact-sheets\u002Fcrypto-fact-sheet-7-28-22.html) (July 2022) says deposit insurance does not apply to crypto assets and does not protect against the default, insolvency, or bankruptcy of non-bank entities, including crypto custodians and exchanges.\n\n## What did the August 2026 card contract incident show?\n\nIt showed that shared infrastructure creates shared risk. A single contract version used by several programs became a single point of failure.\n\nOn August 28, 2026, unauthorized withdrawals hit card balances held in a Rain-managed Solana contract. Rain described it as [a vulnerability](https:\u002F\u002Fx.com\u002Fraincards\u002Fstatus\u002F2093435073081053518) \"impacting a small number of programs using an outdated version of our Solana contracts.\" Rain upgraded the contracts the same day and confirmed repayment the next day.\n\nTwo affected programs published numbers:\n\n| Program | Affected users | Amount | Outcome |\n| --- | --- | --- | --- |\n| Tria | 636 | $431,945 | Every affected user being refunded in full (per [SpendNode](https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Ftria-rain-solana-card-vulnerability-636-users-refund-august-2026\u002F), August 29, 2026) |\n| Avici | 1,685 | $500,859 | Refunds processed in full with an extra 10% cashback (per [SpendNode](https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Favici-solana-card-refunds-complete-10-percent-cashback-august-2026\u002F), August 30, 2026) |\n\nSelf-custodial wallets were reported unaffected because they sat outside the affected contract. Rain had not published a full post-mortem at the time of writing, and not every program built on Rain was exposed.\n\nSelf-custodial cards have their own contract risk. Gnosis Pay reported an exploit of its Delay and Roles modules on June 1, 2026, and its [post-mortem](https:\u002F\u002Fgnosispay.com\u002Fblog\u002Fpost-mortem-gnosis-pay-vulnerability-exploit) says attackers extracted $1.5 million and that Gnosis absorbed the losses and restored all funds to users. [Custodial vs self-custodial stablecoin cards](\u002Fresources\u002Fmore\u002Fcustodial-vs-self-custodial-stablecoin-cards) compares how each model fails.\n\n## How does account fraud happen on a stablecoin card?\n\nMostly the same way it happens on any card: stolen card numbers, phishing, and account takeover. The card rails are the same, so the same protections apply.\n\nWhat changes is the recovery path. Card purchases go through network dispute rules, but a stablecoin transfer out of your wallet is final once confirmed. If an attacker gets into the account that funds the card, they may move stablecoins out directly instead of using the card. [Are stablecoin payments reversible?](\u002Fresources\u002Fmore\u002Fare-stablecoin-payments-reversible) explains why onchain transfers cannot be pulled back.\n\nWatch for these scam signals:\n\n- Guaranteed yield or rewards that sound too good.\n- An upfront fee before the card is issued.\n- No identity checks at all. Card rails require cardholder identification even when the wallet is permissionless, as [neobankbeat notes](https:\u002F\u002Fwww.neobankbeat.com\u002Fblog\u002Fstablecoin-cards-explained).\n- No named issuing bank, e-money institution, or card network.\n\n## What should you check before trusting a stablecoin card?\n\nRun through ten checks. A program that fails several of them is not worth a large balance.\n\n1. **License.** The issuer or program names a licensed bank or e-money institution, and you can find it on the regulator's public register.\n2. **Segregation.** The terms say customer funds are segregated from the company's own money.\n3. **Custody model.** You know whether the program or you hold the stablecoins.\n4. **Contract security.** For onchain programs, audits are public and the program has a record of handling incidents.\n5. **Freeze controls.** You can freeze and unfreeze the card instantly in the app.\n6. **3-D Secure.** Online purchases need an extra confirmation step.\n7. **Limits.** You can set daily and per-transaction limits.\n8. **Login security.** The account supports strong two-factor authentication.\n9. **Small balance.** You keep only near-term spending money on the card.\n10. **Exit path.** You know how to move money out to a bank account if the card stops working.\n\n## Where does BlindPay fit?\n\nThe tenth check, an exit path, is where BlindPay sits. A card is a spending interface. Getting money out to a bank account needs a payout rail.\n\nBlindPay converts USDC or USDT into local currency over Pix, SPEI, ACH, RTP, SEPA, and SWIFT (POBO\u002FCOBO), with KYC, KYB, and sanctions screening built into the API flow. For payouts from wallets the customer controls, BlindPay works as a non-custodial payment processor: the customer authorizes the exact amount and BlindPay executes that single transaction, so the stablecoins stay in the customer's wallet until a payout is authorized. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet or the sending wallet; on Pix and other non-USD local rails the refund is automatic, while USD payouts and payouts whose review times out are refunded after an operator review. Managed wallets, offered in beta, are custodial when a customer chooses that path.\n\nFor card programs, that means the payout leg does not add another pooled balance to the risk list. [Non-custodial payments explained](\u002Fresources\u002Fmore\u002Fnon-custodial-payments-explained) covers the model in more detail.\n\n## How to use a stablecoin card more safely today\n\nPick a licensed program, keep a small balance, and turn on every control the app offers. Then make sure you can reach a bank account without the card.\n\nIf you run a card program and want a payout path that keeps funds under your customers' control, test it on a free BlindPay development instance with the [payout quickstart](\u002Fdocs\u002Fquickstart-payout). For the layers behind every card, read [what stablecoin card issuing is](\u002Fresources\u002Fmore\u002Fwhat-is-stablecoin-card-issuing). For the business-side view of the same risks, see [are stablecoin payments safe](\u002Fresources\u002Fmore\u002Fare-stablecoin-payments-safe).\n\n## Sources\n\n- FDIC, [What the public needs to know about FDIC deposit insurance and crypto companies](https:\u002F\u002Fwww.fdic.gov\u002Fnews\u002Ffact-sheets\u002Fcrypto-fact-sheet-7-28-22.html), July 28, 2022\n- Rain, [statement on the Solana contract vulnerability](https:\u002F\u002Fx.com\u002Fraincards\u002Fstatus\u002F2093435073081053518), August 2026\n- SpendNode, [Tria details Rain card vulnerability: 636 users, $431,945 refunded](https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Ftria-rain-solana-card-vulnerability-636-users-refund-august-2026\u002F), August 29, 2026\n- SpendNode, [Avici completes refunds with 10% cashback](https:\u002F\u002Fwww.spendnode.io\u002Fblog\u002Favici-solana-card-refunds-complete-10-percent-cashback-august-2026\u002F), August 30, 2026\n- Gnosis Pay, [Post-mortem: Gnosis Pay vulnerability exploit](https:\u002F\u002Fgnosispay.com\u002Fblog\u002Fpost-mortem-gnosis-pay-vulnerability-exploit)\n- neobankbeat, [Stablecoin cards explained](https:\u002F\u002Fwww.neobankbeat.com\u002Fblog\u002Fstablecoin-cards-explained), November 18, 2025\n",{"title":5,"description":523},"Are stablecoin cards safe? The 5 risks to check","resources\u002Fmore\u002Fare-stablecoin-cards-safe","T33f8KHHN7gd9c4QcGEoMfOBes-1GXFTtWgX4BfbJto",[552,553,556,560,564,568,572,576,579,583,587,591,595,599,603,607,611,615,619,623,627,631,635,639,643,647,651,655,659,663,667,671,675,679,683,686,690,694,698,701,705,709,713],{"path":545,"title":5,"description":523},{"path":454,"title":554,"description":555},"Are stablecoin payments safe? The risks businesses should check, and how to reduce them","Stablecoin payments are as safe as the issuer, the network, the provider, and your own controls. The seven risks to check, with real incidents and fixes.",{"path":557,"title":558,"description":559},"\u002Fresources\u002Fmore\u002Fbest-stablecoin-apis-cross-border-payments-2026","Best stablecoin APIs for cross-border payments in 2026: BlindPay, Circle, Stripe, Bridge, and Fireblocks compared","Five stablecoin APIs compared for cross-border payments: primary use case, pre-funding requirement, payout regions, and developer experience, plus how to choose by buyer scenario.",{"path":561,"title":562,"description":563},"\u002Fresources\u002Fmore\u002Fbest-stablecoin-apis-2026","Best stablecoin APIs in 2026: 10 providers compared","Ten stablecoin APIs compared for 2026: BlindPay, Circle, Bridge, BVNK, Fireblocks, Crossmint, Zero Hash, Conduit, Sphere, and Borderless, across rails, custody, pricing, and compliance.",{"path":565,"title":566,"description":567},"\u002Fresources\u002Fmore\u002Fbest-virtual-account-providers-stablecoins","Best virtual account providers for stablecoins in 2026: BlindPay, Bridge, HIFI, Noah, and Conduit compared","Five virtual account providers for fiat and stablecoins compared on deposit rails, settlement chains, account naming, and custody, plus a 30-day test plan.",{"path":569,"title":570,"description":571},"\u002Fresources\u002Fmore\u002Fbusiness-vs-consumer-crypto-on-ramps","Business vs consumer crypto on-ramps: what changes when a company buys stablecoins","A consumer on-ramp sells crypto to one person, usually by card. A business on-ramp turns company bank deposits into stablecoins via an API. What differs.",{"path":573,"title":574,"description":575},"\u002Fresources\u002Fmore\u002Fcrypto-debit-card-vs-stablecoin-card-for-business","Crypto debit card vs. stablecoin card for business: custody, accounting, tax, and controls compared","Why a company should treat crypto debit cards and stablecoin cards differently: budget predictability, custody risk, per-swipe tax events, accounting, and spend controls.",{"path":304,"title":577,"description":578},"Custodial vs. self-custodial stablecoin cards: who actually holds your money?","Who holds the stablecoins behind your card: custodial vs. self-custodial models, smart-account allowances, failure modes, and what August 2026 showed.",{"path":580,"title":581,"description":582},"\u002Fresources\u002Fmore\u002Fdo-you-need-a-crypto-wallet-for-stablecoin-payments","Do you need a crypto wallet to make stablecoin payments?","Who needs a wallet in a stablecoin payment, who doesn't, and how payment providers hide keys, networks, gas, and confirmations from payers and recipients.",{"path":584,"title":585,"description":586},"\u002Fresources\u002Fmore\u002Fhow-merchants-accept-stablecoin-payments","How merchants accept stablecoin payments: the complete 2026 guide","To accept stablecoin payments you need a receiving method, an off-ramp to local currency, and a settlement account. The full flow, costs, and options.",{"path":588,"title":589,"description":590},"\u002Fresources\u002Fmore\u002Fstablecoin-payment-orchestration-cross-border-payouts","How stablecoins fit into payment orchestration for cross-border payouts","Stablecoins are a settlement rail inside an orchestration strategy, not a replacement for banking. What changes: pre-funding, settlement time, FX visibility, and last-mile delivery over Pix and SPEI.",{"path":592,"title":593,"description":594},"\u002Fresources\u002Fmore\u002Faccept-bank-transfers-settle-in-stablecoins","How to accept bank transfers and settle in stablecoins using virtual accounts","Accept ACH, wire, and SWIFT and settle in USDC or USDT: the flow, the token, chain, and custody choices, and when a virtual account beats a memo code.",{"path":596,"title":597,"description":598},"\u002Fresources\u002Fmore\u002Fhow-to-choose-a-blockchain-payment-api","How to choose a blockchain payment API: a technical buyer's checklist","Seven checks for a blockchain payment API: SDKs, OpenAPI quality, abstraction level, networks, built-in compliance, local payout rails, and pricing.",{"path":600,"title":601,"description":602},"\u002Fresources\u002Fmore\u002Fhow-to-choose-a-stablecoin-api","How to choose a stablecoin API: the 6 questions that actually matter","Six criteria for evaluating a stablecoin API: pre-funding, compliance automation, local payout rails, settlement speed, developer experience, and pricing transparency, with a scorecard you can send to every vendor.",{"path":604,"title":605,"description":606},"\u002Fresources\u002Fmore\u002Fhow-to-evaluate-a-wallet-integration-provider","How to evaluate a wallet integration provider: 12-point checklist","A 12-point checklist for choosing a wallet or stablecoin payments provider: custody, chains, rails, pricing, compliance, SOC 2, SLAs, and AI tooling.",{"path":608,"title":609,"description":610},"\u002Fresources\u002Fmore\u002Fhow-to-fund-a-stablecoin-card","How to fund a stablecoin card: exchanges, wallet transfers, virtual accounts, and bank deposits","Four ways to fund a stablecoin card, compared by speed, cost, and control: exchange withdrawal, wallet transfer, virtual account deposit, and card top-up.",{"path":612,"title":613,"description":614},"\u002Fresources\u002Fmore\u002Fis-stripe-a-stablecoin-api","Is Stripe a stablecoin API? What a payout API, Stripe, and Bridge each do","Partly. Stripe offers stablecoin checkout and balances, and owns Bridge, a stablecoin infrastructure API. What each covers for cross-border payouts.",{"path":616,"title":617,"description":618},"\u002Fresources\u002Fmore\u002Fis-xrp-a-stablecoin","Is XRP a stablecoin? No, and here is the difference","XRP is not a stablecoin: its price floats freely with the market. Ripple's actual stablecoin is RLUSD. Here is how the two differ and why it matters.",{"path":620,"title":621,"description":622},"\u002Fresources\u002Fmore\u002Fstablecoin-api-pricing-explained","Stablecoin API pricing: mint fees, spread, and what you actually pay","The basis-point figure on a stablecoin provider's pricing page rarely matches the invoice, because mint fees, burn fees, spread, and issuer fees usually live below the line the marketing page shows.",{"path":624,"title":625,"description":626},"\u002Fresources\u002Fmore\u002Fstablecoin-api-vs-crypto-payment-gateway","Stablecoin API vs crypto payment gateway: what's the difference?","A crypto payment gateway accepts crypto at checkout. A stablecoin API moves money across borders through code, and neither side needs a wallet.",{"path":628,"title":629,"description":630},"\u002Fresources\u002Fmore\u002Fstablecoin-api-vs-traditional-cross-border-rails","Stablecoin API vs traditional cross-border rails: a plain-English guide for payments teams","A stablecoin API moves money across borders using dollar-pegged tokens like USDC instead of correspondent banks. How the flow works, what no pre-funding means, and a side-by-side table against SWIFT.",{"path":632,"title":633,"description":634},"\u002Fresources\u002Fmore\u002Fstablecoin-card-vs-crypto-debit-prepaid-credit","Stablecoin card vs. crypto debit card vs. prepaid vs. credit: which type of crypto card is which?","Four kinds of crypto card compared: funding source, when conversion happens, tax timing, volatility, fees to check, and who each one suits.",{"path":636,"title":637,"description":638},"\u002Fresources\u002Fmore\u002Fstablecoin-depeg-risk-payments","Stablecoin depeg risk for payment companies: what past depegs teach and how to set limits","A depeg hurts a payment flow only while you hold the stablecoin. What USDC's 2023 depeg and UST's collapse teach, and the limits and triggers to set.",{"path":640,"title":641,"description":642},"\u002Fresources\u002Fmore\u002Fstablecoin-payments-statistics-2026","Stablecoin payment statistics 2026: volume, B2B share, and cross-border data","Sourced stablecoin payment statistics for 2026: real payment volume vs transfer volume, B2B share, domestic vs cross-border, top markets, and chains.",{"path":644,"title":645,"description":646},"\u002Fresources\u002Fmore\u002Fstablecoin-card-statistics-2026","State of stablecoin cards 2026: volume, programs, networks, and risks (data report)","Sourced stablecoin card statistics for 2026: Visa volume and programs, monthly onchain spend, average ticket, chain and token mix, and incidents.",{"path":648,"title":649,"description":650},"\u002Fresources\u002Fmore\u002Ftypes-of-stablecoin-apis","Types of stablecoin APIs: issuer, wallet, orchestration, payout, and non-custodial APIs compared","The five types of stablecoin APIs, what each one does, and who holds the funds and the compliance work in each. Plus how they differ from exchange APIs.",{"path":652,"title":653,"description":654},"\u002Fresources\u002Fmore\u002Fusdc-vs-usdt-for-payments","USDC vs USDT for payments: which should businesses use?","USDC offers stronger reserve transparency and US regulatory posture; USDT offers deeper liquidity in emerging markets. Most payment flows should support both.",{"path":656,"title":657,"description":658},"\u002Fresources\u002Fmore\u002Fvirtual-account-fees","Virtual account fees: every cost between the payer's bank and the stablecoin wallet","Monthly, deposit, wire, SWIFT, conversion, and partner fees on a virtual account: who pays each one, and a worked 10,000 USD wire to USDC example.",{"path":660,"title":661,"description":662},"\u002Fresources\u002Fmore\u002Fvisa-mastercard-stablecoin-settlement","Visa and Mastercard stablecoin settlement explained: what changed in 2025 and 2026","How Visa's USDC settlement and $7B run rate, Mastercard's BVNK deal, and INFINIOS in Bahrain change card settlement, and what stays the same for payouts.",{"path":664,"title":665,"description":666},"\u002Fresources\u002Fmore\u002Fwallet-api-vs-embedded-wallet-sdk-vs-white-label","Wallet API vs embedded SDK vs white-label: which fits?","Compare the three wallet integration models on control, launch time, engineering effort, security, lock-in, and cost, with a five-question decision tree.",{"path":668,"title":669,"description":670},"\u002Fresources\u002Fmore\u002Ftypes-of-crypto-off-ramps","What are the types of crypto off-ramps? Payment APIs, off-ramp wallets, exchanges, OTC desks, and wallet ramps compared","The five kinds of crypto off-ramp compared: who each serves, who holds funds, limits, trade-offs, consumer vs business, and why stablecoins win.",{"path":672,"title":673,"description":674},"\u002Fresources\u002Fmore\u002Fwhat-happens-on-chain-in-a-stablecoin-payment","What happens on-chain in a stablecoin payment? A step-by-step walkthrough","A stablecoin payment in five steps: bank deposit, conversion to USDC or USDT, on-chain delivery to a wallet, payout authorization, and local currency out.",{"path":676,"title":677,"description":678},"\u002Fresources\u002Fmore\u002Fwhat-is-usdc","What is USDC? The dollar-pegged stablecoin explained","USDC is a dollar-pegged stablecoin issued by Circle, backed 1:1 by cash and short-term Treasuries and redeemable for US dollars. How it works and where it's used.",{"path":680,"title":681,"description":682},"\u002Fresources\u002Fmore\u002Fwhat-is-a-stablecoin-api","What is a stablecoin API? Infrastructure explained","A stablecoin API lets businesses move money with stablecoins through code: wallets, conversion, local payout rails, and compliance behind one integration.",{"path":20,"title":684,"description":685},"What is a stablecoin-backed card? How spending USDC with a card works, in plain English","A stablecoin-backed card spends USDC or USDT wherever Visa or Mastercard works. The four parts behind it, who does what, and where the money comes from.",{"path":687,"title":688,"description":689},"\u002Fresources\u002Fmore\u002Fwhat-is-a-stablecoin","What is a stablecoin? Definition, types, and how they work","A stablecoin is a digital token designed to hold a fixed value, usually one US dollar. Learn how they stay stable, the main types, and what they are used for.",{"path":691,"title":692,"description":693},"\u002Fresources\u002Fmore\u002Fwhat-is-an-off-ramp-wallet","What is an off-ramp wallet? A deposit address that pays out to a bank account","An off-ramp wallet turns every USDC or USDT deposit into fiat paid to a linked bank account, with no quote or payout call. How it works, fees, minimums.",{"path":695,"title":696,"description":697},"\u002Fresources\u002Fmore\u002Fwhat-is-crypto-wallet-integration","What is crypto wallet integration? A developer's guide","Crypto wallet integration adds wallets, key custody, signing, and compliance to an app. The six components, three integration models, and cost drivers.",{"path":449,"title":699,"description":700},"What is stablecoin card issuing? How it works, who uses it, and how it differs from crypto debit cards","Stablecoin card issuing explained: how a USDC or USDT balance pays a card merchant in local currency, who runs each layer, and how it differs from a crypto debit card.",{"path":702,"title":703,"description":704},"\u002Fresources\u002Fmore\u002Fwhat-is-stablecoin-infrastructure","What is stablecoin infrastructure? The 8 layers of a stablecoin payments stack","Stablecoin infrastructure is the stack that issues, moves, converts, secures, and checks stablecoins. Here are its 8 layers and who provides each.",{"path":706,"title":707,"description":708},"\u002Fresources\u002Fmore\u002Fstablecoin-card-demand-by-country","Where stablecoin card demand is growing: the US, India, UAE, Vietnam, Pakistan, and beyond","Which countries ask AI about stablecoin cards most, why interest is rising in India, the UAE, Vietnam, and Pakistan, and where local payouts matter.",{"path":710,"title":711,"description":712},"\u002Fresources\u002Fmore\u002Fbest-network-to-off-ramp-stablecoins","Which network should you use to off-ramp stablecoins? Finality, fees, and confirmations by chain","How Ethereum, Polygon, Base, Arbitrum, Solana, Tron, Stellar, Tempo, and Arc compare for off-ramps: time to finality, fee model, and which tokens work.",{"path":191,"title":714,"description":715},"Which stablecoin is best for card spending? USDC vs USDT vs euro stablecoins","Which stablecoins power crypto cards in 2026: USDC vs USDT vs euro stablecoins and synthetic dollars, compared on reserves, rules, chains, and support.",1791908481211]