WEEKLY WRAP · 2026-09-01
4 quick hits · market context · 14 cards updated
INDUSTRY
Rain sits underneath more card programmes than most people realise, and on August 28 an attacker found a version of its Solana collateral contract that had never been upgraded. The flaw handed administrative control over individual card-collateral accounts to whoever asked for it. Avici disclosed $500,859 taken from 1,685 users and watched AVICI fall as much as 49% intraday, from a 24-hour high near $0.43 to a record low around $0.217. Tria disclosed more than $430,000 from 636 users. Both pledged to refund every affected balance in full, and neither has published a timetable. Now do the arithmetic, because it does not close: roughly $1.1 million moved on-chain, the two disclosures account for about $931,000, and the remainder belongs to programmes nobody has named. Rain says the vulnerability was confined to an outdated contract version used by Avici and a small number of other programmes, that every programme on that version has been upgraded, and that it has seen no further unauthorised activity since. Here is the part that should bother you if you read our last two wraps. When Kulipa went insolvent in July we wrote, twice, that the cards pulling from a self-custody wallet at the moment of purchase came through it fine. That was true, and it was true about custody specifically. It is not a general immunity. Avici's collateral sits in a user-controlled smart contract, which is the architecture we have been praising all summer, and it got emptied anyway because the contract was the hole. Both companies confirmed that self-custodied wallet balances were untouched and only pre-loaded card balances were exposed, which is the distinction to actually keep: money you have already moved onto a card is exposed to whatever code is holding it, no matter whose name is on the wallet. Six other cards in our database run on Rain, the Avalanche Card, Kredete, Karma, Spritz, Stablecard by Western Union and Rain's own. None has been named in any coverage and we have not changed a field on any of them.
Source: CoinDesk Avici Card → Tria Card → Rain Card → Avalanche Card → Spritz Card → Stablecard by Western Union →
EXPANSION
Payward's Krak app launched its Visa debit card in the United States on August 18, its first market after building a reported 125,000-plus cardholders across the UK and EEA since November 2025. The pitch is up to 2% back in dollars or bitcoin, no monthly or annual fee, and a checkout order you set yourself across 600-plus supported balances, so a purchase can drain USDC before it touches your BTC. Rewards land after a transaction settles rather than as points you redeem later. So why does our Krak entry still read UK plus EEA? Because the rate is not flat, and the thresholds behind it are not published. Kraken's own support article ties cashback to a 30-day average balance held across Krak, Kraken and Kraken Pro, and puts the top Max tier at $50,000, the same headline figure as the EUR 50,000 threshold on the European ladder. The Light and Pro thresholds appear nowhere we can read, and a dollar figure matching the euro one to the digit is exactly the sort of number that turns out to be a copy-paste rather than a decision. We would rather carry a stale region field for another week than write a US tier ladder assembled from a European one. Take it as a warning if you are comparing this card in the States: the 2% ceiling is real, and the balance it takes to reach it is the part still missing.
Source: Cointelegraph Krak Card →
RATES
The monthly deep review ran on August 27 and went through every non-discontinued card in the database across sixteen batches, rebuilding each entry from the provider's own pages instead of trusting what we wrote last time. What it found is the useful part. Fifteen cards carried tier structures that appear in no provider document we could locate, and those were replaced with the published ones. Eleven yield figures were stale, including a Gemini SOL auto-staking rate we had been quoting at 6.77% APY since October 2025 against an advertised 6.12% APR. Another thirty-five or so fee and rate fixes landed on top. Four of them change the answer outright if you were comparing: Crypto.com's top tier is 5% and there is no 8% Prime tier, Wirex pays in USD under Wirex One rather than in WXT, Tria's Signature and Premium are recurring annual memberships and not one-time issuance fees, and Jupiter Global is a debit card that we had filed as credit. Five cards came off as discontinued, each with the provider doing the confirming. Amp Pay's own site now tells users to export their private keys and move funds out. Bitsika wound down its no-KYC card pilot and turned the domain into a mobile-game top-up site. Crypto Diffusion's domain is parked on a brokerage and listed for sale. hi has deleted every card page, help article and fee section it controls while continuing to run everything else. SecondFi we had already buried in July. Seventeen more cards we simply could not verify, and instead of bumping a date on them we left the timestamp alone and put a verification-gap line on the entry so you can see which numbers we are publishing without a fresh source. Our read: the tier ladders are the finding that matters. A wrong ATM fee costs you a few dollars once. A tier that exists only in a comparison table sends you chasing a rate nobody ever offered.
Source: Card Pilled Crypto.com Visa Card → Wirex Card → Tria Card → Jupiter Global Card → Gemini Credit Card →
SHUTDOWN
Under four weeks after announcing it would shut down after nine years, BitMart told users it is exploring a restructuring that could pair distributions to creditors with a phased resumption of parts of the business. White & Case is in as restructuring counsel, and a roadmap is expected by September 9. Notice what did not move: trading still ended and the withdrawal-request cutoff still fell on August 26, exactly as announced in July, which means anyone who read the restructuring news as a reprieve and sat on their hands filed late or not at all. We made this card's wind-down a hero item on August 11 and we are not reversing it on this. The BitMart Card was funded from an exchange account and its up-to-5.5% USDT ladder keyed off exchange VIP level, so it stays discontinued until deposits and card issuance actually resume rather than when a filing says they might. Our read: a company that has appointed restructuring counsel and committed to nothing is running a legal process, not announcing a product. September 9 is the date, and we will look at it then.
Source: PYMNTS BitMart Card
Market Context
Two weeks, and the through-line is one we keep arriving at from new directions: the thing that decides whether your card works is almost never the thing the card advertises. The Rain exploit is the sharpest version yet. Avici and Tria both did the architecturally correct thing, holding collateral in non-custodial smart contracts instead of parking a float with an issuer, and it did not save the balances, because the contract holding them had not been upgraded. We spent July and August telling you that self-custody was the variable separating the Kulipa survivors from the casualties. That was true about custody. It was never immunity from code, and this is us saying so in the same place we said the other thing. Our own deep review turned up the domestic version of the same problem. Fifteen cards in our database carried tier ladders that no provider document we can find actually publishes, and eleven yield figures were months out of date. Those were not provider fabrications. They were ours, sitting where nobody looked twice, which is precisely the failure we named after the August 7 rotating check and then went and repeated. The rest of the fortnight was ordinary in a way that is almost reassuring. Krak reached the US with a real headline rate and no published thresholds under it. BitMart hired restructuring counsel and may yet un-close, roadmap due September 9. The EU's MiCA review consultation closed on August 31 with nothing card-specific decided, which matters only because whatever comes out of it will reshape European cards more than any launch this year will. We are at 187 cards and 155 active after adding bitFlyer, El Dorado, Cashi and Sovrae and marking five discontinued. Honestly, the most useful thing we wrote in two weeks was the verification-gap line now sitting on seventeen entries, saying out loud that we are publishing a figure we could not re-source. Every comparison site has entries like that. Most of them just do not tell you which ones.
Cards updated this week: Crypto.com Visa Card → Wirex Card → Tria Card → Jupiter Global Card → Gemini Credit Card → OKX Card → Lava Card → X Money Card → Lemon Card → Robinhood Gold Card →
New cards added: bitFlyer Credit Card → El Dorado Card → Cashi Card → Sovrae Card →
← Previous issue: August 11–17, 2026 | All issues: Weekly Wraps archive →