\n
![](\"https:\/\/media.crypto.news\/2025\/04\/crypto-news-card-credit-market-payment-option03.webp\")
<\/p>\n
\n<\/p>\n
Crypto debit card failures have exposed how little control some wallet and fintech brands hold over their payment services, with a $1.1 million Rain contract exploit illustrating the risks of shared infrastructure.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n Ron Tarter, co-founder and CEO of MNEE App, told crypto.news that companies relying heavily on banking-as-a-service platforms may control little beyond their app, card design and marketing.<\/p>\n A sponsor bank provides the banking permissions and holds fiat deposits, while a processor authorizes transactions. Identity checks, compliance, fraud prevention and crypto wallet services can sit with separate vendors, he explained.<\/p>\n \u201cYou can have millions of users and a strong brand and still not hold the final authority over your own product.\u201d<\/p>\n<\/blockquote>\n In Tarter\u2019s account, founders often underestimate the sponsor bank\u2019s authority. A bank or program manager can restrict or terminate a program it considers too risky, leaving the consumer-facing company unable to restore service by itself.<\/p>\n He cited Kulipa\u2019s summer insolvency, which he said disrupted card programs serving roughly twenty wallets and fintechs. Customers, he added, may discover an interruption only when trying to pay.<\/p>\n <\/p>\n Separate incidents involved losses inside the infrastructure supporting payments. Gnosis said its June 1 attack exploited software modules used by its card-safe system, forcing card services offline. Its July 3 postmortem<\/a> said attackers extracted $1.5 million and rendered another $300,000 inaccessible. The company absorbed the losses and restored users\u2019 funds, as covered in the June exploit reporting<\/a>.<\/p>\n On Aug. 28, an outdated Rain contract exposed several Solana-based card programs to approximately $1.1 million in theft, according to Blockaid\u2019s findings detailed in the Rain card exploit<\/a>. The attacker targeted stablecoin collateral deposited for card spending, without accessing personal wallets or private keys.<\/p>\n Before selecting a partner, Tarter recommends establishing exactly where customer money sits: individual bank accounts or a pooled account held for customers, commonly described as an FBO account.<\/p>\n With pooled funds, he said, companies should ask who reconciles the customer ledger, how frequently that happens, and whether the bank keeps its own copy. His preferred safeguards include individual accounts in customers\u2019 names and daily copies of balances and records held by the brand.<\/p>\n US insurance protection has separate conditions. The Consumer Financial Protection Bureau\u2019s payment-app analysis<\/a> explains that pass-through deposit insurance depends on regulatory requirements being satisfied. Deposit insurance protects against the insured bank\u2019s failure; it does not cover the nonbank app company\u2019s failure.<\/p>\n For security checks, the executive recommends independent assessments such as SOC 2 Type II reports and questions about how a platform supervises other programs sharing its infrastructure. Insurance discussions should establish the size of covered losses and whether a major incident could overwhelm the provider financially.<\/p>\n Choosing two providers does not necessarily create independent backup arrangements, Tarter warned. Both may rely on the same sponsor bank, leaving the brand exposed to one institution\u2019s decisions.<\/p>\n Multiple issuers and backup processors can help during shorter outages, he said, but each relationship brings another technical integration, compliance process, and ledger to reconcile. Larger fintechs can afford those arrangements more easily; smaller companies may struggle with the cost and work involved.<\/p>\n \u201cGetting through one bank\u2019s underwriting took us more than a year.\u201d<\/p>\n<\/blockquote>\n His recommendation is to map every intermediary, obtain the subcontractor list, and establish whether direct contact with the sponsor bank is possible. Contracts should address an upstream provider\u2019s acquisition, shutdown, security breach, or decision to withdraw services.<\/p>\n\n\n
\n
Crypto debit card brands depend on decisions upstream<\/h2>\n
Customer records need to survive a provider\u2019s collapse<\/h2>\n
Backup partners can share the same underlying bank<\/h2>\n
\n