Crypto Card Security Incidents

Crypto.com, January 2022: the 2FA bypass

On 17 January 2022, attackers withdrew crypto from Crypto.com accounts without the two-factor authentication the accounts required. Crypto.com's official post-mortem, published 20 January 2022 and covered by TechCrunch and Decrypt the same day, put the damage at 483 affected users and unauthorized withdrawals of 4,836.26 ETH, 443.93 BTC, and about $66,200 in other cryptocurrencies, roughly $34 million in total. Withdrawals were suspended for about 14 hours while the company investigated.

The outcome is the part worth remembering: every affected account was fully reimbursed, the company rebuilt its 2FA infrastructure, and it launched a Worldwide Account Protection Program covering up to $250,000 for qualified users. The lesson for card users is that exchange linked cards inherit exchange account risk. Your card is only as safe as the login standing in front of it, and in 2022 that login could be stepped around.

Infini, February 2025: the insider who kept the keys

On 24 February 2025, about $49.5 million in USDC was drained from a vault belonging to Infini, a stablecoin neobank with its own card program. Analysis by security firms Cyvers and QuillAudits, reported by Decrypt and catalogued in The Block's roundup of the biggest crypto hacks of 2025, tied the drain to a former developer whose administrative privileges on Infini's contracts had never been revoked after he left. The flaw was not exotic code. It was an access control failure: credentials that should have been deleted were still live more than three months later.

Infini's founder pledged that affected users would be fully compensated, and the company said withdrawals and payments continued. Four months later, on 17 June 2025, Infini suspended its Global, Lite, and Tech cards, citing compliance costs. The sequence is the lesson: an exploit does not have to take your money directly to end your card. It only has to damage the company enough that the card stops being worth running. When a card program dies after an incident like this, it joins the long list of discontinued programs we track on our graveyard page.

Gnosis Pay, June 2026: self-custody is not the same as safe

Gnosis Pay is the flagship self-custodial card: funds sit in the user's own Safe smart wallet, and the card spends from it. On 1 June 2026, attackers exploited an ERC-1271 signature validation flaw in the Zodiac Delay and Roles modules that Gnosis Pay card wallets rely on, code that had carried the flaw since October 2023. According to Gnosis Pay's official post-mortem, published 3 July 2026, about $1.5 million was extracted, roughly $300,000 more became temporarily inaccessible, and about 5,281 wallets were affected. PeckShield flagged the attack publicly while it was underway.

The response was the best in this guide: root cause identified in about two hours, services restored to roughly 99% of users by 6 June, and Gnosis Pay absorbed the entire loss so users lost nothing. Keep both halves of that sentence. The model worked exactly as designed and users were still exposed, because self-custody moves risk from a company's vault into smart contract code, and code has bugs. What protected users in the end was not the architecture. It was the provider's decision to pay.

Rain, Avici, and Tria, August 2026: one contract, many brands

On 28 August 2026, an attacker exploited an outdated version of a Solana card contract operated by Rain, the issuing infrastructure provider behind a large share of the self-custody card market. Blockchain security firm Blockaid, which disclosed the incident on 2 September 2026, estimated total losses of about $1.1 million across the programs running the vulnerable contract. Avici reported $500,859.22 taken from the card balances of 1,685 users. Tria reported about $431,945 across 636 customers.

Two details matter. First, no user's wallet or private keys were touched. The money that left was the money sitting in card collateral contracts, the balance users had loaded in order to spend. Second, the brands were not the failure point: the shared issuer infrastructure underneath them was, which meant cardholders of competing products had the same bad day. Affected users were refunded in full, with Rain covering the refunds and Avici and Tria each adding 10% on top, and Rain said every program on the vulnerable contract version was upgraded. This incident is the strongest argument in this guide for knowing who issues your card, which is why we built the brand to issuer map in our BIN guide.

Based, October 2026: the breach that took data, not money

On 5 October 2026, an unauthorized party accessed an internal dashboard used to manage the Based Visa Card program. In statements on 11 and 12 October 2026, reported by PANews and Cryptopolitan, Based co-founder Edison Lim said KYC data collected for the card may have been exposed: names, passport or national ID numbers, dates of birth, addresses, email addresses, and phone numbers. Based said card numbers, CVVs, and PINs were not in the dataset, that its self-custodial trading wallet was unaffected, and that it had notified Singapore's Personal Data Protection Commission and filed a police report. No loss of customer funds has been confirmed.

This is the incident type card users underestimate. Money can be refunded. A passport number, birth date, and home address, linked to the knowledge that you hold crypto, cannot be un-leaked. Every crypto card requires KYC, so every cardholder has a file like this sitting with a provider or its vendor. Choose programs the way you would choose anyone you hand identity documents to.

The one we could not verify: Wirex

Readers ask about Wirex because it is one of the oldest names in crypto cards, and old names attract rumors. We looked for a platform level Wirex security incident in reputable reporting before writing this guide, and we did not find one. Incident tracking reviews of Wirex likewise report no known platform hack or breach. What does exist is a long tail of individual account compromises, phishing losses, and bitter support and chargeback disputes, which is a service quality story, not a breach story. We are recording the non-finding rather than laundering rumor into fact. No platform incident is not the same as no risk: account level attacks are how most users actually lose money, on Wirex and everywhere else.

The patterns, and what actually protects you

Five incidents, four different failure modes: an authentication bypass, an insider's leftover access, a smart contract flaw, shared issuer infrastructure, and a vendor dashboard. There is no single product feature that defeats all of them, including self-custody. What helps is boring and cumulative:

• Keep card balances small. Every dollar sitting in a card account, vault, or collateral contract is a dollar exposed to that program's worst day. Top up close to when you spend.
• Hold the bulk of your funds in a wallet only you control, separate from any card. In the Rain exploit, untouched wallets were the whole reason the losses stopped at card balances.
• Use a hardware wallet or passkey, a unique password, and app based 2FA on the account behind the card. The Crypto.com incident was, at root, a login failure.
• Know your issuer and spread your risk. A second card on a different issuer is real redundancy; a second card on the same issuer is a spare copy of the same risk. Our BIN guide maps the major programs.
• Treat your KYC data as semi-public. Use a unique email address for card programs, and think before uploading identity documents to a program you barely know.
• During an incident, do nothing quickly. Refunds in every case above were automatic. Urgent messages asking you to verify, claim, or move funds mid-incident are scams riding the news.
• Pick providers by their response record. Gnosis Pay and the Rain programs published numbers, timelines, and refunds. That behavior, visible before you need it, is the closest thing to a safety rating this industry has.