Crypto Cards: Where Your Card Balance Really Sits and What the August 28 Solana Exploit Reveals About It

When you pay with a crypto card, the money backing that card frequently does not sit in your own wallet. It sits in a separate container operated by the card platform and filled by you when you top up. On August 28, 2026 an attack on exactly such a container showed what that means when things go wrong: users' self-custodied wallets were left untouched, and the loaded card balance was gone.

The provider concerned is not available in Germany. The construction behind it, however, is. This piece places the incident in context, explains the terms and shows you how to tell which custody model your own card uses and who would be responsible in the event of a loss.

What happened in Avici's Solana card contract on August 28, 2026

Avici is a so-called neobank on the Solana blockchain: an app that attaches a Visa card to an on-chain account of its own. On August 28, 2026 the provider disclosed that there was a problem with card payouts. According to the reconstruction by crypto.news, the first malicious transaction occurred at 16:49:48 UTC, and reporting began in the early evening.

On the provider's account, what was affected was neither the Solana network nor the users' app wallet, but a single smart contract in which the backing for the cards is held. Anyone who left their funds in the app without loading them onto the card stood outside the attack. Anyone who had topped up stood inside it.