At the checkout, every crypto card looks the same. Behind it, the money can sit in very different places: with an exchange, in a licensed issuer's safeguarded account, inside a smart contract run by a card program, or in a wallet you control. That choice, known as the custody model, decides what happens when something breaks. Over the summer of 2026 several things did break, which makes it a good moment to understand who actually holds your money before you swipe.
Quick Summary
- A crypto card is only as safe as the custody model behind it, meaning who legally holds the funds before a payment.
- DeFi Prime's September 2026 review sorts card programs into five custody models, from "sold to the operator" to "your own vault".
- 2026 showed a different failure for each: a smart-contract exploit at Rain-run programs, the collapse of issuer Kulipa, and the wind-down of Cypher.
- Custodial cards expose you to a company failing. Non-custodial cards expose you to contract bugs, lost keys and cards that disappear.
- All five cards we review are custodial (Nexo keeps your collateral in your Nexo portfolio), so the habit that matters most is keeping only near-term spending on the card.
The Five Ways a Crypto Card Can Hold Your Money
In a September 2026 analysis, DeFi Prime read the published terms of the card programs it tracks and grouped them into five custody models. The table below summarizes that classification.
| Model | What you actually hold | Examples named | Main risk |
|---|---|---|---|
| 1. Sold to the operator | A USD claim on the company, not the coins themselves. KAST's terms cap its liability at $500. | KAST | You are an unsecured creditor if the company fails. |
| 2. Held in custody for you | Beneficial ownership, while a custodian holds legal title. | RedotPay, Revolut, Coinbase Card | Custodian failure, and whatever the terms you accepted allow. |
| 3. Converted to fiat at a licensed issuer | Only fiat sits on the card. Your crypto stays with the exchange until it is sold. | Crypto.com, Krak Card, Bybit | Exchange custody plus issuer failure. Safeguarding rules help but do not remove the risk. |
| 4. Your collateral in the program's contract | Funds in a smart contract that the program operator writes and can upgrade. | Avici, Tria, Payy | Contract bugs and the operator's upgrade control. |
| 5. Your own vault, debited at payment | A wallet or smart account the operator cannot simply move. | Gnosis Pay, Ether.fi Cash, Bleap | Smart-contract and key risk, and the card program shutting down. |
The lines are not always clean. Ether.fi, for example, describes its vault as self-custody with a corporate recovery signer as a backstop, which DeFi Prime calls "self-custody with an operator-shaped backstop". Treat the buckets as a way to ask better questions, not as a safety ranking.
What Went Wrong in 2026, and Who Was Protected
The Rain contract exploit (late August)
On August 28, 2026 (some outlets dated it August 30), an attacker exploited an authorization bug in an outdated version of Rain's Solana card contracts. About $1.1 million was reported drained across several programs. Avici disclosed roughly $500,859 lost across 1,685 users and Tria roughly $431,945 across 636 users. Both programs refunded affected users in full, reportedly within about a day, and Avici added a 10% bonus. Avici said its self-custodial wallets were untouched: the loss came from the separate contract where users had moved balances for the card. Rain said every deployment still running the affected version has since been upgraded. This is the fourth model in action: your funds sit in a contract someone else wrote.
The Kulipa collapse (July 28)
The card issuer Kulipa wound down at the end of July, and card programs for around 20 wallet and fintech clients, including Ready and Solflare, stopped working at once. Because those cards debited users' own wallets at the moment of purchase, Kulipa held no customer balances and user funds were unaffected. The cards themselves were dead until a new issuer was found. This is the fifth model in action: the vault protected the money, not the convenience.
The Cypher wind-down (July to September)
On July 8, 2026 Nium announced it was acquiring Cypher, a non-custodial wallet and card company. Card loading and new applications stopped, and Cypher's notice says the app and card stop working on September 6, 2026. Users kept control of their assets, but had to spend down or withdraw card balances and move recurring payments to another card before the deadline.
The pattern is the useful part. No custody model prevented every problem, and each one failed in its own way.
Custodial vs Non-Custodial: The Honest Trade-Offs
| Custodial | Non-custodial | |
|---|---|---|
| Who holds the keys | The exchange, issuer or custodian | You, through a wallet or vault that grants the card limited spending permission |
| Typical failure | Issuer or exchange insolvency, account freezes, unfavorable terms | Smart-contract bugs, lost or phished keys, the program shutting down |
| What can protect you | Licensing and safeguarding rules, such as EU e-money rules, and the issuer's terms | Architecture: funds you can withdraw without the operator, and public contracts controlled by a multisig or timelock |
| What you must do | Read the insolvency terms and keep balances small | Secure your keys and check who can upgrade the contracts you rely on |
Neither column wins outright. Custodial cards are usually simpler to top up and come from regulated issuers, but you are trusting a company with your balance. Non-custodial cards cut out that trust, but you take on technical risk and depend on a program that can still close its doors.
Ready to Spend Your Crypto?
Compare crypto cards on fees, limits and availability, then open an account with the provider that fits how you spend.
Get Your Card →The Hidden Risk: One Company Behind Many Cards
Different logos do not always mean different plumbing. DeFi Prime's tracking put about $468 million of the roughly $1.116 billion in August 2026 crypto card volume (around 42%) through Rain, and reported that seven programs name Rain's affiliate Third National as their issuer. Some volume figures, such as RedotPay's, are self-reported rather than verifiable on-chain, so treat these numbers as estimates. The takeaway holds either way: two cards from different brands can share one issuer, one codebase and one point of failure.
Where the Cards We Review Fit
All five cards in our comparison are custodial. The Crypto.com and Bybit cards spend an exchange balance, the Binance Card spends a Funding wallet balance, and the Wirex Card spends a Wirex account balance. The Nexo Card keeps your collateral in your Nexo portfolio and lets you borrow against it. None is a self-custody card. That is the trade for simple top-ups and regulated issuers, and it is why the size of the balance you leave on any of them matters. See the full comparison for fees and limits.
Five Questions to Ask Before You Load a Card
- Which custody model is it? Look for words like "sale", "nominee", "e-money", "collateral" or "vault" in the terms.
- Who is the issuer, by legal name? "Licensed partners" is not an answer. Name the entity, and check whether other cards share it.
- What do the terms say about insolvency? Many say nothing. Silence is worth noting.
- Who can upgrade the contract? For contract-based cards, a single key with upgrade power is a bigger risk than a public multisig or a timelock.
- How much am I leaving on it? Load what you plan to spend soon and keep the rest in cold storage. Our crypto card security guide covers the rest of the habits.
Frequently Asked Questions
What is the difference between a custodial and a non-custodial crypto card?
With a custodial card, an exchange, issuer or custodian holds your crypto or the fiat it is converted into, and you rely on that company. With a non-custodial card, your funds stay in a wallet or smart-contract vault you control, and the card only gets permission to spend from it at payment time.
Are non-custodial crypto cards safer?
They remove one risk, the operator failing while holding your money, but add others: smart-contract bugs, lost keys, and the card program shutting down. In 2026 the Rain exploit hit balances users had moved into a card contract, while the Kulipa and Cypher shutdowns stopped cards without touching self-custodial wallets.
Did users lose money in the 2026 Rain card exploit?
Users were not left with the loss. Avici and Tria, the two programs that disclosed figures, said they refunded all affected users in full, and Avici added a 10% bonus. The refunds came from company balance sheets, not from recovered funds.
How much should I keep on a crypto card?
Only what you expect to spend soon. Whatever the custody model, a card balance is exposed to the issuer, the contract or the account behind it, so keep long-term holdings in cold storage or a wallet you control.
What happens to my funds if a card issuer shuts down?
It depends on the custody model. If the card debited your own wallet at purchase, as Ready and Solflare cards did when Kulipa wound down, your funds stayed put but the card stopped working. If the issuer or an exchange held your balance, you become a claimant under that company's terms and local safeguarding rules.
Sources checked 2026-09-19
- Crypto Cards in 2026: Who Holds the Money Before the Swipe, DeFi Prime, September 10, 2026
- Rain contract exploit drains $1.1M from card users, crypto.news
- Avici says everyone's card balance refunded in full as Rain fixes crypto card vulnerability, AMBCrypto
- Ready Shuts Card Program After Issuer Kulipa's Sudden Wind-Down, The Defiant
- Notice of Termination of Services, Cypher
- Nium acquires Cypher to scale on-chain infrastructure, FinTech Futures
Disclosure: VisaCryptoCard is an independent guide site. Figures come from the linked sources and may change, so verify current terms before you load a card.
Start Cashing Out Crypto Today
Pick the card that fits your country and spending, then open an account with the provider directly. Our comparison shows the fees and limits first.
Get Your Card →