Rain’s $1.1 million exploit shows how one flaw can hit several crypto card brands

A single outdated smart contract at payments provider Rain let an attacker drain about $1.1 million from several Solana crypto card programs on August 28, 2026, a case MNEE App CEO Ron Tarter says shows how many crypto firms depend on banks and processors they do not control.

Crypto debit cards expose weaknesses in shared payment infrastructure

The increasing adoption of crypto debit cards is bringing renewed attention to the risks associated with third-party payment infrastructure.

According to a report published by crypto.news on November 10, 2026, several cryptocurrency payment providers depend on the same underlying financial institutions and technology companies to deliver card services.

The concerns were highlighted by Ron Tarter, co-founder and chief executive officer of MNEE App, who explained that many cryptocurrency businesses have limited control over the infrastructure supporting their products.

Under the banking-as-a-service model, cryptocurrency companies typically depend on sponsor banks to provide the necessary banking permissions and hold customers’ fiat deposits.

Payment processors handle transaction authorizations, while separate service providers may manage identity verification, regulatory compliance, fraud prevention and wallet-related functions.

This arrangement allows businesses to launch financial products without establishing their own banking infrastructure. However, it also introduces dependencies that may become problematic when a service provider experiences financial difficulties, security breaches or regulatory complications.

Tarter explained that having a recognizable brand does not necessarily mean a company controls the underlying systems responsible for its customers’ transactions.

Co-founder and CEO of MNEE App, Ron Tarter spoke to Crypto.news saying, you can have millions of users and a strong brand and still not hold the final authority over your own product.

Even companies with substantial customer bases may be unable to prevent service interruptions if a banking partner or infrastructure provider decides to terminate its relationship.

Rain’s $1.1 million exploit raises security concerns

One of the incidents drawing attention to the vulnerabilities of shared payment infrastructure involved Rain, a provider supporting cryptocurrency card programs.

On August 28, 2026, an attacker exploited an outdated Rain smart contract, resulting in approximately $1.1 million in losses across several Solana-based card programs, according to findings from blockchain security firm Blockaid.

The affected infrastructure supported multiple cryptocurrency payment businesses, demonstrating how a vulnerability within one provider’s systems can create problems for several independent brands.

The incident affected several payment providers, including Avici and Tria. Avici reported approximately $500,859 in losses involving 1,685 users, while Tria disclosed around $431,945 affecting 636 customers.

Another incident involving Gnosis Pay demonstrated the potential consequences of weaknesses in shared smart contract infrastructure. Following an attack discovered on June 1, 2026, Gnosis reported that approximately $1.5 million had been extracted, while another $300,000 became inaccessible.

According to the company’s July 3 post-incident report, Gnosis absorbed the losses and restored customer funds. The systems holding funds after customers deposit them for spending may have separate security vulnerabilities.

Banking partnerships and customer protection remain critical

Beyond technical vulnerabilities, the financial structure supporting crypto payment services presents another challenge.

Tarter advised cryptocurrency companies to establish exactly where customer deposits are held before entering agreements with banking and payment infrastructure providers.

One important consideration is whether funds are maintained in individual bank accounts or consolidated into a pooled account, commonly referred to as a for-benefit-of (FBO) account.

With pooled arrangements, companies need to understand how customer balances are recorded, reconciled and protected. They must also establish whether the sponsor bank maintains independent records that can be accessed if the intermediary responsible for managing the accounts shuts down.

Tarter recommends that businesses maintain independent copies of customer balances and transaction records, alongside arrangements that provide customers with stronger protection if a service provider becomes insolvent.

Another important consideration is deposit insurance. In the United States, eligible bank deposits may qualify for Federal Deposit Insurance Corporation (FDIC) protection, subject to applicable requirements.

However, this protection does not automatically extend to every cryptocurrency application or fintech company holding customer funds.

The Consumer Financial Protection Bureau (CFPB) has previously explained that pass-through deposit insurance depends on specific regulatory and recordkeeping requirements being satisfied. It also distinguishes between the failure of an insured bank and the failure of a nonbank payment application.

Backup providers may not eliminate operational risks

For cryptocurrency businesses, having multiple infrastructure partners may appear to be an effective strategy for reducing operational disruptions. However, this approach does not necessarily guarantee independence.

Tarter warned that two separate payment providers could depend on the same sponsor bank. If that institution withdraws its support or experiences operational problems, both arrangements could be affected.

Establishing relationships with multiple banks, card issuers and payment processors can improve business continuity.

Tarter recommends that cryptocurrency companies map their entire infrastructure, identify every intermediary involved and obtain information about subcontractors supporting their payment services.

Understanding the banking relationships, custody arrangements, smart contract security and financial protections behind a product is equally important.

Conclusion

The recent security incidents involving Rain and Gnosis Pay demonstrate that the risks facing cryptocurrency payment services extend beyond individual applications.

Shared banking relationships, payment processors and smart contract infrastructure can create interconnected vulnerabilities capable of affecting multiple companies and their customers.

Although crypto debit cards offer greater convenience for spending digital assets, their long-term reliability will depend on stronger security practices, transparent custody arrangements and independent infrastructure safeguards.

For investors and everyday users, evaluating the institutions and technology providers operating behind a payment platform is becoming just as important as examining the company offering the card.