Crypto Cards: Where Your Card Balance Really Sits and What the August 28 Solana Exploit Reveals About It

When you pay with a crypto card, the money backing that card frequently does not sit in your own wallet. It sits in a separate container operated by the card platform and filled by you when you top up. On August 28, 2026 an attack on exactly such a container showed what that means when things go wrong: users' self-custodied wallets were left untouched, and the loaded card balance was gone. The provider concerned is not available in Germany. The construction behind it, however, is. This piece places the incident in context, explains the terms and shows you how to tell which custody model your own card uses and who would be responsible in the event of a loss. What happened in Avici's Solana card contract on August 28, 2026 Avici is a so-called neobank on the Solana blockchain: an app that attaches a Visa card to an on-chain account of its own. On August 28, 2026 the provider disclosed that there was a problem with card payouts. According to the reconstruction by crypto.news, the first malicious transaction occurred at 16:49:48 UTC, and reporting began in the early evening. On the provider's account, what was affected was neither the Solana network nor the users' app wallet, but a single smart contract in which the backing for the cards is held. Anyone who left their funds in the app without loading them onto the card stood outside the attack. Anyone who had topped up stood inside it. How the attack worked technically On the account given by Cryptopolitan, the attacker exploited the payout logic of the program written in Rust by calling the functions SubmitSignatures, AddCollateralAdmin and WithdrawCollateralAsset one after another. The middle step is the decisive one: with it the attacker entered himself as an authorised administrator of the collateral and could then withdraw what had been deposited through the regular route. The episode was not a single grab. According to the breakdown Avici published later, the attack series comprised 14,672 transactions, of which 2,344 failed. That points to an automated script working through the contract systematically over hours rather than to a one-off strike. Card balance contract: what it is and why it is not your wallet A card balance contract is a standalone program on a blockchain into which you transfer funds so that a payment card can draw on them. As soon as you top up, the money leaves your wallet and sits in that contract until a card payment is settled or you pull it back. The difference from a wallet is practical rather than theoretical. Your wallet is protected by a key only you hold.