Crypto debit cards expose risks from shared payment providers
Crypto debit card failures have exposed how little control some wallet and fintech brands hold over their payment services, with a $1.1 million Rain contract exploit illustrating the risks of shared infrastructure.
Summary
- Shared banks, processors, and middleware can leave separate card brands exposed to the same failure.
- Rain’s August exploit targeted funded card balances, leaving customers’ personal wallets and private keys untouched.
- MNEE App CEO Ron Tarter recommends direct bank relationships and independently accessible customer records.
- US deposit insurance covers eligible bank deposits against bank failure, not a fintech provider’s collapse.
Ron Tarter, co-founder and CEO of MNEE App, told crypto.news that companies relying heavily on banking-as-a-service platforms may control little beyond their app, card design and marketing.
A sponsor bank provides the banking permissions and holds fiat deposits, while a processor authorizes transactions. Identity checks, compliance, fraud prevention and crypto wallet services can sit with separate vendors, he explained.
“You can have millions of users and a strong brand and still not hold the final authority over your own product.”
Crypto debit card brands depend on decisions upstream
In Tarter’s account, founders often underestimate the sponsor bank’s authority. A bank or program manager can restrict or terminate a program it considers too risky, leaving the consumer-facing company unable to restore service by itself.
He cited Kulipa’s summer insolvency, which he said disrupted card programs serving roughly twenty wallets and fintechs. Customers, he added, may discover an interruption only when trying to pay.
Separate incidents involved losses inside the infrastructure supporting payments. Gnosis said its June 1 attack exploited software modules used by its card-safe system, forcing card services offline. Its July 3 postmortem said attackers extracted $1.5 million and rendered another $300,000 inaccessible. The company absorbed the losses and restored users’ funds, as covered in the June exploit reporting.
On Aug. 28, an outdated Rain contract exposed several Solana-based card programs to approximately $1.1 million in theft, according to Blockaid’s findings detailed in the Rain card exploit. The attacker targeted stablecoin collateral deposited for card spending, without accessing personal wallets or private keys.
Customer records need to survive a provider’s collapse
Before selecting a partner, Tarter recommends establishing exactly where customer money sits: individual bank accounts or a pooled account held for customers, commonly described as an FBO account.
With pooled funds, he said, companies should ask who reconciles the customer ledger, how frequently that happens, and whether the bank keeps its own copy. His preferred safeguards include individual accounts in customers’ names and daily copies of balances and records held by the brand.
US insurance protection has separate conditions. The Consumer Financial Protection Bureau’s payment-app analysis explains that pass-through deposit insurance depends on regulatory requirements being satisfied. Deposit insurance protects against the insured bank’s failure; it does not cover the nonbank app company’s failure.
For security checks, the executive recommends independent assessments such as SOC 2 Type II reports and questions about how a platform supervises other programs sharing its infrastructure. Insurance discussions should establish the size of covered losses and whether a major incident could overwhelm the provider financially.
Backup partners can share the same underlying bank
Choosing two providers does not necessarily create independent backup arrangements, Tarter warned. Both may rely on the same sponsor bank, leaving the brand exposed to one institution’s decisions.
Multiple issuers and backup processors can help during shorter outages, he said, but each relationship brings another technical integration, compliance process, and ledger to reconcile. Larger fintechs can afford those arrangements more easily; smaller companies may struggle with the cost and work involved.
“Getting through one bank’s underwriting took us more than a year.”
His recommendation is to map every intermediary, obtain the subcontractor list, and establish whether direct contact with the sponsor bank is possible. Contracts should address an upstream provider’s acquisition, shutdown, security breach, or decision to withdraw services.
A separate November data breach at Gnosis Pay affected its branded consumer cards, while the company said its enterprise platform and customer funds were unaffected.
To prepare for a provider’s failure, Tarter recommends direct contractual rights to continue a program or move it, alongside notice periods before termination. He said MNEE previously abandoned plans to launch FBO accounts through an unnamed provider after concerns about lacking a direct bank relationship. The provider subsequently shut down and entered Chapter 11 proceedings, according to his account.
