Who holds the stablecoins behind your card: custodial vs. self-custodial models, smart-account allowances, failure modes, and what August 2026 showed.
A custodial stablecoin card keeps your USDC or USDT in wallets the provider controls and tracks your balance on its ledger. A self-custodial card leaves the stablecoins in a wallet you control and lets the card spend only within an allowance you set. Custodial is easier to recover. Self-custodial means the provider never holds your money.
The card in your hand looks the same either way. What changes is who can move the funds, what happens if the company behind the card fails, and what you lose if you lose your phone.
This guide explains both models, how smart-account allowances work, and what a real incident in August 2026 showed about shared infrastructure. For the basics, read what a stablecoin-backed card is and the issuing view in what stablecoin card issuing is.
Key takeaways
Three terms describe who controls the money at each point. They are often mixed up, so here are plain definitions.
A card can be custodial or self-custodial. A payout or collection service sitting next to the card can be non-custodial. The three describe different jobs.
In a custodial program, you send stablecoins to the provider and it keeps them in wallets it controls. When you tap the card, the program checks its ledger, places a hold, and approves in milliseconds.
This is how most exchange-linked cards work. Coinbase Card, for example, spends from a Coinbase account balance, per Coinbase's card page.
In a self-custodial program, the stablecoins stay in a wallet you control, usually a smart account. You grant the card a spending allowance, and the program can only pull up to that limit.
neobankbeat's explainer on stablecoin cards (November 2025) describes this as a spending allowance enforced by the smart contract. It also makes a point people miss: "Even fully self-custodial programmes must identify cardholders... The wallet may be permissionless; the plastic isn't."
Gnosis Pay is the best documented example. Per its documentation:
Coin Bureau's card roundup (updated March 2026) describes Gnosis Pay as a self-custodial spend card focused on the EEA and UK, with no added FX markup beyond the Visa rate.
The trade-off is control against convenience. Custodial cards are easier to use and recover. Self-custodial cards keep the provider from ever holding your funds.
| Custodial card | Self-custodial card | |
|---|---|---|
| Who holds the stablecoins | The provider or its custodian | You, in a wallet or smart account |
| Balance check at purchase | Internal ledger | Onchain balance and allowance |
| Convenience | High; works like a fintech app | Good, but you manage a wallet |
| Recovery if you lose access | Provider resets your login | Depends on your wallet's recovery setup |
| If the provider fails | Your balance depends on how it held and segregated funds | Your stablecoins stay in your wallet |
| If the smart contract has a bug | Provider's own contracts and wallets at risk | Your account modules may be at risk |
| Identity check | Required | Required |
| Deposit insurance | No | No |
Neither column has deposit insurance. The FDIC's fact sheet on crypto companies says its insurance does not apply to crypto assets and does not protect against the failure of non-bank entities such as crypto custodians and exchanges.
On August 28, 2026, attackers made unauthorized withdrawals from card balances held in a Rain-managed Solana contract. Rain said the vulnerability affected a small number of programs using an outdated version of its Solana contracts, and affected users were reimbursed.
The public timeline, from the companies' statements and SpendNode's coverage:
Rain's own statement described the scope as "a small number of programs using an outdated version of our Solana contracts." It would be wrong to assume every program on the same issuer was exposed. Rain had not published a full post-mortem by late August.
The useful lesson is about shared infrastructure. Card balances sat in a common contract that several programs used, so one bug reached users of several brands at once. Self-custodial wallets sat outside that contract and were reported unaffected.
Yes. Self-custody moves the risk from the provider's balance sheet to your keys and the code that sets your allowance. That code can fail too.
Gnosis Pay published a post-mortem on a June 1, 2026 exploit involving its Delay and Roles modules. Per that post-mortem, attackers extracted $1.5 million, and Gnosis absorbed the losses and restored all funds to users. It is still a reminder that the modules protecting a self-custodial card are software, and software gets audited, patched, and sometimes exploited.
The other self-custody risk is personal. Lose your keys without a recovery setup, and no support team can restore them.
Choose based on what you fear more: a provider failing, or yourself losing access. Most people are better served by one model, and a few use both.
Before choosing, read the card terms for the issuer's name, how funds are held and segregated, and what happens to balances if the provider winds down.
The card covers spending. Funding the card wallet and cashing out to a bank are separate movements, and they can also be designed so no provider holds your money in between.
BlindPay is a stablecoin API for global payments that works this way for payouts. It operates as a non-custodial payment processor for payout flows from customer-controlled wallets: you authorize the exact amount and BlindPay executes that single transaction. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet, or to the sending wallet when none is set. On Pix and other non-USD local rails the refund is automatic; USD payouts and payouts whose review times out are refunded after an operator review. Optional BlindPay-managed wallets (beta) are custodial when you choose that path.
For a card program, that means users can move stablecoins from the wallet behind their card into local currency over Pix, SPEI, ACH, RTP, SEPA, and SWIFT (POBO/COBO) without parking a balance with another provider first. The BlindPay introduction covers the model, and the payout quickstart runs a test payout on a free development instance.
The five risks of a stablecoin card: peg, program failure, custody, smart contracts, and fraud, with the August 2026 incident and a safety checklist.
Stablecoin payments are as safe as the issuer, the network, the provider, and your own controls. The seven risks to check, with real incidents and fixes.
Five stablecoin APIs compared for cross-border payments: primary use case, pre-funding requirement, payout regions, and developer experience, plus how to choose by buyer scenario.