Verify a decision

{"actor":"system:backfill","investigation_id":"1fd032c0-d5f4-404e-a6ab-adec85f65f25","kind":"publish","page_slug":"rain-financial-crypto-card-infrastructure","published_at":"2026-09-15T17:04:12.555Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Rain Financial (Crypto Card Infrastructure)","sections":[{"content":"Rain operates under the legal name Signify Holdings, Inc. and was founded in 2021 by Farooq Malik (CEO) and Charles Naut (CTO). Malik previously served as treasurer and investment officer of the North American Development Bank. The company is headquartered in New York City and describes itself as a business-to-business infrastructure provider rather than a consumer-facing bank, exchange, or asset custodian. Rain's core products include stablecoin card issuance, wallets, on/off-ramps, virtual accounts, and cross-border payment rails. Payment products are delivered through partnerships with licensed institutions, and banking services for fiat-side balances are provided by SSB (Member FDIC), with FDIC insurance up to $250,000 per depositor. Rain explicitly states it does not hold deposits directly. As of mid-2026, Rain claimed to facilitate transactions at over 175 million merchant locations in 150+ countries and reported that its active card base had grown 30x and annualized payment volume had grown 38x over the prior year.","heading":"Company Background and Operations","severity":"low","sources":[{"credibility":2,"name":"Rain official website — About Us","type":"official","url":"https://www.rain.xyz/about-us"},{"credibility":2,"name":"Rain Series C press release — PR Newswire","type":"news_article","url":"https://www.prnewswire.com/news-releases/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises-302657084.html"},{"credibility":2,"name":"Farooq Malik, CEO of Rain — SALT Speaker Bio","type":"other","url":"https://www.salt.org/speakers/farooq-malik"}]},{"content":"Rain raised a $24.5 million Series A led by Norwest Venture Partners in March 2025, followed by a $58 million Series B led by Sapphire Ventures, and then a $250 million Series C in January 2026 led by ICONIQ Growth, bringing total disclosed funding to over $338 million. The Series C valued Rain at $1.95 billion. Co-investors across rounds include Dragonfly, Bessemer Venture Partners, Galaxy Ventures, FirstMark, Lightspeed, Norwest, Endeavor Catalyst, and Coinbase Ventures. The rapid sequential funding — three rounds in approximately ten months — reflects substantial institutional interest in stablecoin payment infrastructure, though it also concentrates counterparty risk in a single infrastructure provider that processed roughly 42% of tracked crypto card volume as of August 2026.","heading":"Funding and Investor Backing","severity":"low","sources":[{"credibility":2,"name":"Rain raises $250M Series C — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises"},{"credibility":2,"name":"Rain hits $1.95bn valuation with $250m Series C — Fintech Futures","type":"news_article","url":"https://www.fintechfutures.com/venture-capital-funding/rain-hits-1-95bn-valuation-with-250m-series-c"},{"credibility":2,"name":"Rain secures $250M Series C — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/01/257233-rain-secures-250m-series-c-funding-to-scale-stablecoin-payments/"},{"credibility":2,"name":"Crypto Cards in 2026: Who Holds the Money Before the Swipe — DeFi Prime","type":"research","url":"https://defiprime.com/crypto-cards-who-holds-the-money"}]},{"content":"On August 28, 2026, an attacker exploited an authorization flaw in an outdated version of Rain's Solana card-collateral smart contract. The vulnerability involved a signature-verification bypass: the contract used Solana's Ed25519 verification system and required two separate approvals before certain administrative actions. The attacker manipulated signature offsets so that a single attacker-controlled signature satisfied both authorization checks, allowing the attacker to register themselves as an administrator over individual user collateral accounts and execute withdrawals without account-owner permission. The attacker conducted 8,233 transactions over approximately 2.5 hours, draining USDC and USDT from collateral accounts across at least four Rain-powered card programs: Avici ($500,859 from 1,685 users), Tria ($431,945 from 636 users), Solayer Pay, and others. Total losses were estimated at approximately $1.1 million. The stolen funds were swapped to SOL, bridged via deBridge to Ethereum, and deposited into Tornado Cash, making recovery effectively impossible. Blockchain security firm Blockaid analyzed the exploit and confirmed funds were not recovered. Rain traced the issue to the outdated contract version, upgraded all programs running that version, and reported no further unauthorized activity. Self-custodial wallets held outside the card-collateral contract system were not affected. Avici and Tria each reimbursed affected users in full and added a 10% cashback incentive. Rain reportedly covered the refunds from company reserves within 24 to 48 hours of the exploit. The AVICI token fell approximately 49% from its 24-hour high in the immediate aftermath before partially recovering. The incident exposed a gap between Rain's marketing of a 'non-custodial' model and the operational reality: Rain held upgrade authority and administrative privileges over the smart contracts that held user card balances, and a single plaintext signing key controlled upgrade authority on the affected programs until at least September 5, 2026, according to DeFi Prime's analysis. The outcome — rapid reimbursement from Rain reserves — demonstrates that practical user recourse depended on Rain's solvency and willingness to pay, not solely on contract architecture.","heading":"August 2026 Solana Smart Contract Exploit","severity":"high","sources":[{"credibility":1,"name":"A Solana-based $1.1 million crypto card hack crashed a neobank's token 49% — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/08/29/a-usd1-1-million-crypto-card-hack-crashed-a-neobank-s-token-49"},{"credibility":2,"name":"Rain contract exploit drains $1.1M from card users — crypto.news","type":"news_article","url":"https://crypto.news/rain-contract-exploit-drains-1-1m-from-card-users/"},{"credibility":2,"name":"Avici says everyone's card balance refunded in full as Rain fixes crypto card vulnerability — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/avici-says-everyones-card-balance-refunded-in-full-as-rain-fixes-crypto-card-vulnerability/"},{"credibility":2,"name":"Tria Details Rain Card Vulnerability: 636 Users, $431,945 Refunded — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/tria-rain-solana-card-vulnerability-636-users-refund-august-2026/"},{"credibility":2,"name":"Avici - Rain Card Exploit Explained: What Happened? — Gizmo Times","type":"news_article","url":"https://www.gizmotimes.com/security/avici-rain-card-exploit-solana-vulnerability-explained/51243"},{"credibility":2,"name":"Crypto Cards in 2026: Who Holds the Money Before the Swipe — DeFi Prime","type":"research","url":"https://defiprime.com/crypto-cards-who-holds-the-money"}]},{"content":"Rain has pursued several formal security certifications. The company achieved SOC 2 certification and PCI DSS compliance, the latter announced via press release with no specific date disclosed. Rain's General Counsel and Chief Compliance Officer Christopher Grieco noted that PCI DSS compliance complements SOC 2 and ongoing smart contract audits by Sherlock. Prior to the August 2026 exploit, Rain's Solana contracts were described as undergoing third-party audits. However, the August exploit demonstrated that an outdated contract version with a known authorization architecture flaw remained in active deployment across multiple partner programs, raising questions about the scope and cadence of smart contract audit and deprecation processes. Following the exploit, Rain upgraded all programs using the vulnerable version. Rain is a Visa Principal Member and a Mastercard Principal Member, both of which carry compliance requirements for card program management. The company also announced expansion of its Visa membership into Asia-Pacific in March 2026 and a strategic partnership with Episode Six for card processing in Asia-Pacific in April 2026.","heading":"Security Posture and Compliance","severity":"medium","sources":[{"credibility":2,"name":"Rain achieves PCI DSS compliance — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-achieves-pci-dss-compliance-reinforcing-commitment-to-secure-compliant-stablecoin-infrastructure"},{"credibility":2,"name":"Rain is now a Mastercard Principal Member — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-is-now-a-mastercard-principal-member"},{"credibility":2,"name":"Rain expands Visa Membership into Asia-Pacific — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-expands-into-asia-pacific"}]},{"content":"Rain markets its card infrastructure as enabling a non-custodial model in which individual smart contracts hold user card-collateral balances. However, independent analysis published by DeFi Prime in 2026 identified structural risks in this characterization. Rain maintains upgrade authority and administrative privileges over the smart contracts that hold user card balances. Prior to September 5, 2026, a single plaintext signing key controlled upgrade authority on at least the three programs drained in the August exploit. This means that operational security of the key — and the willingness and solvency of Rain — are the effective protection against loss, not the contract architecture alone. Rain processed approximately 42% of tracked crypto card volume ($468 million of $1.116 billion) in August 2026, representing significant infrastructure concentration risk for the broader crypto card ecosystem. Seven major card programs used Rain's infrastructure at the time of the exploit. Third National, the card issuer referenced in Rain's network, is described as a Puerto Rico money transmitter rather than a federally regulated bank, which affects the regulatory protections available to card users. Rain's terms explicitly state it is not a bank, exchange, or asset custodian, and does not hold deposits directly.","heading":"Custody Model and Concentration Risk","severity":"medium","sources":[{"credibility":2,"name":"Crypto Cards in 2026: Who Holds the Money Before the Swipe — DeFi Prime","type":"research","url":"https://defiprime.com/crypto-cards-who-holds-the-money"},{"credibility":2,"name":"Rain official website — Legal","type":"official","url":"https://www.rain.xyz/legal-center/legal"}]},{"content":"No SEC enforcement actions, CFTC proceedings, DOJ investigations, or court filings against Rain or Signify Holdings, Inc. were identified in available public records as of the date of this investigation. Rain operates as a payments infrastructure provider rather than an exchange or investment platform, which generally places it outside the perimeter of securities regulation. The company describes itself as operating in licensed markets across North America, South America, Europe, Asia, and Africa, though specific license details and jurisdictional coverage are not disclosed in public materials. Rain is a Visa Principal Member and a Mastercard Principal Member, both of which require adherence to card network compliance programs. Rain is a member of the Financial Technology Association (FTA). No evidence of money transmission license violations, regulatory sanctions, or pending litigation was found in available sources.","heading":"Regulatory and Legal Status","severity":"low","sources":[{"credibility":2,"name":"FTA Welcomes Innovative Payments Company Rain — Financial Technology Association","type":"other","url":"https://www.ftassociation.org/fta-welcomes-innovative-payments-company-rain/"},{"credibility":2,"name":"Rain Series C press release — PR Newswire","type":"news_article","url":"https://www.prnewswire.com/news-releases/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises-302657084.html"}]},{"content":"Rain serves over 200 enterprise partners including Western Union, Nuvei, and KAST as of early 2026. Key card-program partners include neobanks Avici and Tria, both of which were affected by the August 2026 exploit. Rain is integrated into the Avalanche blockchain builder ecosystem and has announced partnerships with Rizon and MPCVault for corporate spending cards. In May 2026, Fortune reported that Rain planned to issue cards through Mastercard following its elevation to Mastercard Principal Member status, having previously issued exclusively through Visa. The Episode Six partnership, announced in April 2026, covers card processing for Rain's credit, debit, and prepaid programs in Asia-Pacific. Paymentology has also published a case study referencing Rain as a client.","heading":"Partnerships and Ecosystem","severity":"low","sources":[{"credibility":1,"name":"Stablecoin startup Rain is worth $1.95 billion and plans to issue cards with Mastercard — Fortune","type":"news_article","url":"https://fortune.com/2026/05/04/mastercard-rain-stablecoin-startup-institutional-customers-partnership/"},{"credibility":2,"name":"Rain and Episode Six form long-term partnership — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-and-episode-six-form-long-term-partnership"},{"credibility":2,"name":"Client Story — Rain — Paymentology","type":"other","url":"https://www.paymentology.com/en/client-story-rain"}]}],"sources_used":[{"credibility":1,"name":"A Solana-based $1.1 million crypto card hack crashed a neobank's token 49% — CoinDesk","type":"news_article","url":"https://www.coindesk.com/web3/2026/08/29/a-usd1-1-million-crypto-card-hack-crashed-a-neobank-s-token-49"},{"credibility":1,"name":"Stablecoin startup Rain is worth $1.95 billion and plans to issue cards with Mastercard — Fortune","type":"news_article","url":"https://fortune.com/2026/05/04/mastercard-rain-stablecoin-startup-institutional-customers-partnership/"},{"credibility":2,"name":"Rain contract exploit drains $1.1M from card users — crypto.news","type":"news_article","url":"https://crypto.news/rain-contract-exploit-drains-1-1m-from-card-users/"},{"credibility":2,"name":"Rain raises $250M Series C — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises"},{"credibility":2,"name":"Rain Series C press release — PR Newswire","type":"news_article","url":"https://www.prnewswire.com/news-releases/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises-302657084.html"},{"credibility":2,"name":"Rain hits $1.95bn valuation with $250m Series C — Fintech Futures","type":"news_article","url":"https://www.fintechfutures.com/venture-capital-funding/rain-hits-1-95bn-valuation-with-250m-series-c"},{"credibility":2,"name":"Avici says everyone's card balance refunded in full — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/avici-says-everyones-card-balance-refunded-in-full-as-rain-fixes-crypto-card-vulnerability/"},{"credibility":2,"name":"Tria Details Rain Card Vulnerability: 636 Users, $431,945 Refunded — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/tria-rain-solana-card-vulnerability-636-users-refund-august-2026/"},{"credibility":2,"name":"Avici - Rain Card Exploit Explained — Gizmo Times","type":"news_article","url":"https://www.gizmotimes.com/security/avici-rain-card-exploit-solana-vulnerability-explained/51243"},{"credibility":2,"name":"Crypto Cards in 2026: Who Holds the Money Before the Swipe — DeFi Prime","type":"research","url":"https://defiprime.com/crypto-cards-who-holds-the-money"},{"credibility":2,"name":"Rain achieves PCI DSS compliance — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-achieves-pci-dss-compliance-reinforcing-commitment-to-secure-compliant-stablecoin-infrastructure"},{"credibility":2,"name":"Rain is now a Mastercard Principal Member — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-is-now-a-mastercard-principal-member"},{"credibility":2,"name":"Rain expands Visa Membership into Asia-Pacific — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-expands-into-asia-pacific"},{"credibility":2,"name":"Rain announces $24.5M Series A — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-announces-24-5-million-in-funding-led-by-norwest-to-expand-stablecoin-powered-card-issuing-globally"},{"credibility":2,"name":"Stablecoins as Money: Why We're Thrilled to Lead Rain's Series B — Sapphire Ventures","type":"other","url":"https://sapphireventures.com/blog/stablecoins-as-money-why-were-thrilled-to-lead-rains-series-b/"},{"credibility":2,"name":"FTA Welcomes Innovative Payments Company Rain","type":"other","url":"https://www.ftassociation.org/fta-welcomes-innovative-payments-company-rain/"},{"credibility":2,"name":"Rain and Episode Six form long-term partnership — Rain official blog","type":"official","url":"https://www.rain.xyz/resources/rain-and-episode-six-form-long-term-partnership"},{"credibility":2,"name":"Client Story — Rain — Paymentology","type":"other","url":"https://www.paymentology.com/en/client-story-rain"},{"credibility":2,"name":"Avici to Refund 1,685 Users After $500K Solana Card Contract Exploit — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/avici-to-refund-1685-users-after-500k-solana-card-contract-exploit/"}],"summary":"Rain (legal entity: Signify Holdings, Inc.) is a New York-headquartered fintech company founded in 2021 that provides stablecoin-powered card issuing and payments infrastructure to enterprises, neobanks, and developers. The company is a Visa and Mastercard Principal Member, serves over 200 enterprise partners, and processed roughly $3 billion in annualized transactions as of early 2026. In August 2026, an authorization flaw in an outdated Rain Solana smart contract was exploited, draining approximately $1.1 million from card-collateral accounts across multiple partner programs; Rain upgraded all affected contracts and partner programs reimbursed affected users in full.","timeline":[{"date":"2021-01-01","event":"Rain (Signify Holdings, Inc.) founded by Farooq Malik and Charles Naut in New York City.","source":"Crunchbase / Rain official","source_url":"https://www.crunchbase.com/organization/rain-855d"},{"date":"2025-03-01","event":"Rain closes $24.5 million Series A funding round led by Norwest Venture Partners.","source":"Rain official blog","source_url":"https://www.rain.xyz/resources/rain-announces-24-5-million-in-funding-led-by-norwest-to-expand-stablecoin-powered-card-issuing-globally"},{"date":"2025-09-01","event":"Rain closes $58 million Series B funding round led by Sapphire Ventures.","source":"Sapphire Ventures blog","source_url":"https://sapphireventures.com/blog/stablecoins-as-money-why-were-thrilled-to-lead-rains-series-b/"},{"date":"2026-01-09","event":"Rain announces $250 million Series C led by ICONIQ, valuing the company at $1.95 billion. Total funding exceeds $338 million.","source":"PR Newswire","source_url":"https://www.prnewswire.com/news-releases/rain-raises-250m-series-c-to-scale-stablecoin-powered-payments-infrastructure-for-global-enterprises-302657084.html"},{"date":"2026-03-01","event":"Rain expands Visa Principal Membership into Asia-Pacific.","source":"Rain official blog","source_url":"https://www.rain.xyz/resources/rain-expands-into-asia-pacific"},{"date":"2026-04-01","event":"Rain announces strategic partnership with Episode Six for card processing in Asia-Pacific.","source":"Rain official blog","source_url":"https://www.rain.xyz/resources/rain-and-episode-six-form-long-term-partnership"},{"date":"2026-05-04","event":"Rain announces Mastercard Principal Member status and plans to issue cards on Mastercard network.","source":"Fortune","source_url":"https://fortune.com/2026/05/04/mastercard-rain-stablecoin-startup-institutional-customers-partnership/"},{"date":"2026-08-28","event":"Attacker exploits an authorization flaw in an outdated Rain Solana card-collateral smart contract, draining approximately $1.1 million across at least four card programs including Avici ($500,859 / 1,685 users) and Tria ($431,945 / 636 users). Funds bridged to Ethereum and deposited into Tornado Cash; not recovered.","source":"CoinDesk / crypto.news / Blockaid","source_url":"https://www.coindesk.com/web3/2026/08/29/a-usd1-1-million-crypto-card-hack-crashed-a-neobank-s-token-49"},{"date":"2026-08-30","event":"Avici confirms all 1,685 affected users refunded in full with an additional 10% cashback. Rain upgrades all programs running the vulnerable contract version.","source":"AMBCrypto","source_url":"https://ambcrypto.com/avici-says-everyones-card-balance-refunded-in-full-as-rain-fixes-crypto-card-vulnerability/"},{"date":"2026-09-05","event":"DeFi Prime analysis notes that a single plaintext signing key had controlled upgrade authority on the three drained Rain programs until this date.","source":"DeFi Prime","source_url":"https://defiprime.com/crypto-cards-who-holds-the-money"}]},"v":1}