The malfunction of the crypto debit card revealed that some wallets and fintech brands have limited control over their payment services; Rain’s $1.1 million contract vulnerability highlights the risks associated with shared infrastructure.
- Shared banks, processors, and middleware may expose different card brands to the same failure simultaneously.
- The vulnerability Rain encountered in August targeted funded card balances; customers' personal wallets and private keys were not affected.
- Ron Tarter, CEO of the MNEE App, recommends establishing direct banking relationships and ensuring that customer records are independently accessible.
- U.S. deposit insurance covers eligible bank deposits in the event of a bank failure, not the failure of fintech service providers themselves.
Ron Tarter, co-founder and CEO of the MNEE App, told crypto.news that companies heavily reliant on banking-as-a-service platforms may have little control over anything beyond their app, card design, and marketing.
He explained that the sponsoring bank provides the banking license and holds fiat deposits, while the processor handles transaction authorization; identity verification, compliance, fraud prevention, and cryptocurrency wallet services may also be managed by separate vendors.
You can have millions of users and a powerful brand, yet still not hold the final decision-making power over your own product.
Cryptocurrency debit card brands rely on upstream decisions.
According to Tarter, founders often underestimate the power of sponsoring banks. If a bank or project manager deems a project too risky, they can restrict or terminate it, and consumer-facing companies cannot restore service on their own.
He mentioned that Kulipa became insolvent over the summer, disrupting card programs for approximately 20 wallet and fintech companies. Customers may not discover the service interruption until they attempt to make a payment.
Several other independent incidents involved losses within the payment infrastructure. Gnosis stated that its June 1 attack exploited a software module used by the card security system, forcing card services offline. A post-incident analysis released by the company on July 3 revealed that attackers extracted $1.5 million and rendered an additional $300,000 inaccessible. The company absorbed the losses and restored user funds, as previously disclosed in June vulnerability reports.
According to Blockaid’s investigation into the Rain card vulnerability, on August 28, an outdated Rain contract exposed multiple Solana-based card projects to approximately $1.1 million in theft risk. The attackers targeted stablecoin collateral deposited for card spending and did not access individual wallets or private keys.
Customer records must remain accessible after the service provider goes out of business.
Before selecting a partner, Tarter recommends clarifying where customer funds are held: in individual bank accounts or in pooled accounts held on behalf of clients, commonly known as FBO accounts.
Regarding pooled funds, he said the company should ask who is reconciling the customer ledger, how often reconciliation occurs, and whether the bank retains its own copy. His preferred safeguards include establishing separate accounts in the customers’ names and having the brand hold daily balance and record copies.
Insurance protection in the United States is subject to separate conditions. The U.S. Consumer Financial Protection Bureau’s analysis of payment apps indicates that pass-through deposit insurance depends on compliance with regulatory requirements. Deposit insurance protects against the risk of failure of insured banks, but does not cover the failure of non-bank app companies.
Regarding security reviews, the executive recommended independent assessments such as SOC 2 Type II reports and asked how the platform oversees other projects sharing its infrastructure. In the discussion on insurance, it should be clear what scale of losses is covered and whether the provider would be financially unable to withstand a major incident.
Alternative partners may also share the same underlying bank.
Tarter warned that selecting two service providers does not necessarily mean establishing truly independent backup arrangements; both may rely on the same sponsoring bank, leaving the brand still exposed to the decisions of a single institution.
He noted that multiple issuers and backup processors help mitigate short-term disruptions, but each additional layer introduces further technical integration, compliance processes, and ledgers that require reconciliation. Larger fintech companies are better positioned to absorb these arrangements; smaller firms may struggle with the associated costs and workload.
It took us more than a year to pass the credit approval process of a single bank.
His recommendation is to review each intermediary, obtain a list of subcontractors, and confirm whether direct contact with the sponsoring bank is possible. The contract should cover scenarios such as the upstream service provider being acquired, ceasing operations, experiencing a security breach, or deciding to withdraw its services.
Another Gnosis Pay data breach in November affected its branded consumer cards, but the company stated that its enterprise platform and customer funds were not impacted.
To address the risk of a service provider going out of business, Tarter recommends including contractual rights to directly continue or migrate the project, along with a notice period prior to termination. He stated that MNEE previously abandoned plans to launch an FBO account through an unnamed service provider due to concerns over the lack of direct banking relationships. According to him, that service provider subsequently went out of business and filed for Chapter 11 bankruptcy.