What really happens when you tap a crypto card

You tap, and under a second later the terminal says approved. Inside that second, a contract on a public network moved your dollars out of your own wallet. The card network never knew a blockchain was involved, and that is not a flaw in the design. It is the design.

What actually happens in the second you tap?

Four parties are involved, and only one of them is crypto-shaped. There is the card network, Visa or Mastercard, which routes the message. There is a licensed issuing bank, whose license the card legally sits under. There is a program manager, the company that actually runs the product. And there is your wallet.

The sequence goes like this. The terminal sends an authorization request. The network reads the first digits of the card number, which identify the issuer, and routes the request to that issuing stack. The issuer turns to the program manager and asks one question: does this person have the money? The program manager checks. It answers. The merchant sees an ordinary approval and gets paid in ordinary money, on the ordinary card timetable.

Every crypto-specific thing happens inside that one question. The merchant never touches a token. Neither does the network, at least not on this leg, although both networks now settle in stablecoins between banks further down the chain. A stablecoin card is a normal card with a few hundred milliseconds of crypto grafted into the authorization window.

Where does the money actually sit?

Two models, and the gap between them is the product.

Pre-funded. You top up a balance that the provider holds for you, and the card spends from it. This is how most crypto cards have always worked. It is simple, it supports many chains, and you have handed over custody: the provider can freeze the balance because the provider has the balance.

Pulled just in time. Nothing is pre-loaded. The money stays in your wallet until the instant of purchase. Bridge, the stablecoin company Stripe acquired, documents it precisely: when a card is authorized at a merchant, it verifies that the linked non-custodial wallet has an active on-chain authorization and sufficient funds, then submits an on-chain transaction to pull the funds in real time. If the authorization is inactive or the balance falls short, the card declines.

That model comes with sharp edges worth knowing. The money has to sit on a specific network in a specific token: Bridge’s integration with the wallet provider Privy covers USDC on Solana, and on Base, Linea, World Chain and Tempo. One wallet can be tied to exactly one card. Refunds come back as a separate on-chain transaction, sometimes batched with others.

What does a “non-custodial card” really mean?

Before the card can pull anything, your wallet has to grant permission on-chain, and that step decides everything else. On an Ethereum-style network it is a standard token approval, pointed at an issuer contract specific to that card program. On Solana it is a delegate. That standing permission is what makes the pull possible inside the authorization window, because there is no time to ask you.

So the honest description of a non-custodial card is this: you keep the keys, and you grant somebody a standing right to debit you. Which is a direct debit mandate, written in code.

The size of that mandate is the question nobody asks at signup. A token approval can be capped at a specific amount, or it can be unlimited, and unlimited is the industry default because it saves the user a transaction every time the cap runs out. An unlimited approval lets the contract move your entire balance of that token, so if it is ever compromised the allowance becomes the path in. Check what you signed, and keep the card wallet separate from the wallet holding your savings.

The comparison is genuinely useful rather than dismissive. A bank direct debit is a permission you revoke through a process, with limits your bank decides. An on-chain approval is a permission whose limits are enforced by the contract itself, and only your key can change them. That is a real gain in who holds the controls. It is not the absence of a trusted party. It is a trusted party on a machine-readable leash.

Gnosis Pay makes the leash explicit, and shows what a capped version looks like. Its account is a Safe smart contract wallet on Gnosis Chain with two modules bolted on. A Roles module pins exactly what the card may spend: which token, a daily limit, which destination address. A Delay module holds every non-card transaction, so transfers and withdrawals, for three minutes, and pauses the card while one is pending. Card payments themselves are not delayed. The point is that a payment Visa has already approved cannot be beaten to the money by the owner pulling it out first. The user’s constraint is also the network’s guarantee.

What did Gnosis Pay’s exploit prove?

On 1 June 2026, an attacker drained those accounts, and the story is worth telling straight because it is the best available stress test of the whole category.

The flaw was in the Delay and Roles modules themselves. To let an owner approve actions without holding gas, the code accepted a contract signature and checked the value the contract returned. It read that value but discarded whether the call had actually succeeded. So an attacker could deploy a contract that fails on purpose while still returning the magic number meaning “valid,” and the modules believed it.

Some 5,281 accounts holding at least a dollar were affected. About $1.5 million was extracted and a further $300,000 left inaccessible, around $1.8 million in total. Gnosis absorbed all of it and no user lost funds. The root cause was identified within two hours, an external review was completed on 4 June, and 99% of users had their cards back by 6 June. The bug had shipped in version 3.4.0 on 30 October 2023. It was live for more than two years before anyone used it.

Self-custody did not fail here. It moved the risk, which is not the same as removing it. The module that makes a self-custodial card possible is itself an attack surface, and it is a newer and less-battered surface than a bank’s. Both halves of that sentence are true, and any honest pitch has to carry both.

Who is actually building these?

More people than the category’s reputation suggests. Visa publishes its own numbers: more than 130 stablecoin-linked card programs across over 50 countries, roughly $5.2 billion of volume in 2025, a 319% increase year on year, and an expectation that the number of programs roughly doubles in 2026.

Visa also describes two settlement shapes behind those cards. In the established one, the program manager converts the stablecoin into ordinary money before settling with Visa. In the newer one, Visa Principal Members settle with Visa directly in a coin such as USDC, and Visa’s digital custodian handles the conversion for merchant payouts.

• Bridge issues through Stripe’s card infrastructure in a collaboration it calls exclusive with Visa. In March 2026 the two said the cards were live in 18 countries, and set a target of more than 100 by the end of the year across Europe, Asia-Pacific, Africa and the Middle East.
• Rain is a Visa Principal Member and, since May 2026, a Mastercard Principal Member too. It raised a $250 million Series C at a $1.95 billion valuation.
• MetaMask runs a Mastercard program with Baanx, now Monavate, and brought it to the US on 26 February 2026, issued by Cross River Bank. It was already live across the European Economic Area, the UK, Switzerland, Canada and several Latin American countries. MetaMask describes it as fully self-custodial: users keep custody until the point of purchase.

One caution about labels. “Self-custodial” is used loosely across this market, and it covers everything from a Safe you fully control to a key split between you and a provider. The only reliable test is mechanical: what did your wallet approve, and who holds the key that can change it.

What should you check before using one?

• Who issues it, and under which license. That entity is who can freeze the card, not the app whose logo is on it.
• What you approved on-chain, and how to revoke it. An allowance is a live permission, not a one-off signature.
• The exchange rate, not the fee. On a card that converts, the spread is where the cost lives.
• Which network and token the money must sit on. Funds on the wrong chain are funds the card cannot see.
• Your local tax rules. In the United States the tax authority treats digital assets as property, so paying with one is a disposal you have to report, with no small-transaction exemption. On a dollar-pegged coin the gain is usually close to zero, which makes it paperwork rather than a bill. In France, tax attaches to converting crypto into ordinary money rather than to swapping one token for another, so how a card purchase gets characterized decides everything. Ask someone local.

Why it matters

A card is a bridge to somewhere else. Buying coffee with a token is the boring part. What counts is that a wallet balance can now reach the 175 million merchant locations Visa counts on its network, without anyone opening a bank account in any of those countries, and that the plumbing for it is now boring, licensed and audited enough for Stripe and Visa to put their names on it.

It is also worth noticing what the card is a workaround for. Paying a merchant still needs the card network, because that is where merchants are. Paying a person does not. Friends settling a shared tab can move the money directly in seconds with Spliz, with no card, no conversion and no allowance to revoke. If wallets themselves are new to you, our plain-language wallet explainer is the better place to start.

A card that spends from your wallet is not your wallet paying the merchant. It is a bank promising the merchant, and a smart contract promising the bank.

Sources

• Stripe, Bridge stablecoin-backed cards: the real-time pull at authorization, the on-chain approval, declines and refunds.
• Privy, issuing debit cards against a wallet: the token approval, supported chains and the one-wallet-one-card limit.
• Bridge, card program coverage, the Visa collaboration and the 2026 roadmap.
• Visa, the 3 March 2026 expansion with Bridge: 18 countries live, a target of over 100, and the 175 million merchant locations on the network.
• Visa, stablecoin-linked cards: program count, 2025 volume and growth, and the two settlement models (updated 31 March 2026).
• Gnosis, post-mortem of the 1 June 2026 exploit: the signature bug, accounts affected, amounts and the recovery timeline.
• Gnosis Pay, account architecture: the Safe, the Roles module and the Delay module.
• MetaMask, the US launch of its Mastercard program (26 February 2026): issuer, partner, markets and the custody wording.
• Rain, announcement of its Mastercard Principal Membership (May 2026).
• Rain, the $250 million Series C and the $1.95 billion valuation.
• IRS, digital assets treated as property and the reporting duty when they are exchanged for goods or services.