BLACKHATMAPAffiliate & infrastructure forum

Pick the card by threat model and spend shape, then argue about fees

Started 14 Jun 2026 · 10:47 · 8 replies · 941 views

Page 1 of 19 posts

hexforge

Senior Member

14 Jun 2026 · 10:47#1

Every couple of weeks someone posts a fee table and asks which card is best. The fee table is the last thing to look at, not the first, and I'd rather write this once than argue it again in the next four threads.

Credentials, such as they are: I've run cards from four of the programs discussed on this board over roughly two years. I have never pushed more than about $8k through one in a month, so everything I say about high limits is arithmetic rather than experience and I've flagged where that's the case.

Decide who you are actually hiding from

"No KYC" is not one property. It's at least three, they come apart, and people buy the wrong one constantly.

  1. No identity on file with the issuer. Nobody holds your passport scan. This protects you from a breach at the issuer, and from the issuer handing a folder to whoever asks nicely.
  2. No identity attached to the transaction. The merchant sees a card number and whatever billing address you typed. This is a different property and most cards give it to you whether or not they did KYC.
  3. No link between where the funding came from and where it got spent. This is the one that decides whether any of the above was worth doing, and it's the one nobody optimises for, because you funded the card from an address with a history.

If your threat model is "I don't want a marketing database to hold my legal name", every card in the category works and you should go straight to the fee table. If your threat model involves anyone who can pay a chain analytics firm, the card you picked is close to irrelevant — you lost at point 3, before you chose a product, and no amount of seed-phrase signup fixes it afterwards.

Then match it to how you spend, not how much

The shape of the spend picks the card far more than the total does.

Many small recurring charges. Subscriptions, hosting, ad spend. You want one card that lives a long time, because rotating means re-entering details at every merchant, and every re-entry is a point where something breaks or gets logged. Per-transaction caps mean nothing to you. Program longevity is worth more than a point of top-up fee.

Occasional large one-off purchases. Now the per-transaction ceiling is the entire question. A $5,000 cap sounds generous right up until the thing you're buying is $6,200 and you're splitting it across two cards at the same merchant inside a minute, which is itself a decent fraud signal. Check the per-transaction figure against your largest realistic single charge, not against your monthly total. People check the monthly total. It's the wrong number.

Burner per purchase. Issue, load, spend, walk away. Here the issuance fee is your dominant cost and the top-up percentage is noise. A card at $10 to issue and 0% to load is worse for you than one at $1 to issue and 2% at any basket size you're realistically using. Do that multiplication with your own burn rate before you take anyone's recommendation, including mine.

Only now, the fees

Three numbers, in this order:

  • Issuance fee times the number of cards you'll actually burn in a year
  • Top-up percentage times your annual load
  • Conversion spread, which almost nobody publishes honestly and which is regularly larger than the first two combined

The third is why the fee tables on this board contradict each other. They're all measuring the first two carefully and the third not at all.

What I treat as disqualifying

  • A signup that requires an email address. If a program can mail you, the mailbox is part of the product, and mailboxes get handed over.
  • Single-chain funding. If it only takes SOL and USDC then your funding path is narrow, and a narrow path is a legible one.
  • A monthly ceiling below your actual monthly spend. You'll hit it in week three and then you're onboarding a second product in a hurry, which is exactly when people skip steps.
  • A support channel that is a chat bot with no second channel behind it. Not because support elsewhere is good — it isn't — but because you want to know that up front rather than on the day it matters.

Where I'm not confident

I have no data on any of these programs at volume. Everything above about limits is arithmetic. If you're moving $40k a month, skip that section entirely and go find someone who actually does it, because I'd be guessing and it would sound authoritative.

And none of it survives the program simply closing. Several of these names are new enough that this is the live risk rather than the theoretical one. Spread across two, keep balances thin, treat a top-up as money already spent the moment it lands.

Summary: work out which of the three no-KYC properties you actually need, match the card to the shape of your spend, and only then start arguing about percentages.

137 thanks

Ravenstack

Senior Member

14 Jun 2026 · 11:25↑ replying to #1#2

Point 3 is the only paragraph here that decides anything and it's the shortest one in the post. Everything above it is shopping advice with good manners.

How many of the four did you fund from a genuinely fresh address, and fresh from what?

—

nullroute

Senior Member

14 Jun 2026 · 13:02↑ replying to #1#3

The email rule is superstition and I'd cut it. An address you use nowhere else, on a domain you control, is not a leak — it's a channel, and a channel is how you learn a program is dying while your balance is still spendable. You're trading a real operational benefit against a threat that requires the adversary to already know the address, at which point you had bigger problems.

Everything else stands, and Ravenstack is right that point 3 is underweighted relative to how much it decides.

On "spread across two" I'd go further than you did. Two programs is one program if they're sitting on the same sponsor bank, and none of them will tell you who that is. Two cards is diversification only once you've checked the first six digits land on different ranges. Almost nobody checks, and then a range dies and both of their cards stop on the same afternoon and they post about it separately.

31 thanksopsec is a process, not a purchase

hexforge

Senior Member

14 Jun 2026 · 14:36↑ replying to #3#4

The BIN point is better than what I wrote and I'm going to fold it in.

On email I'll hold, but with a narrower claim than the one I made, because the one I made was too broad. A mailbox is fine. A mailbox that can reset access to the card is not, because at that point the mailbox is the card and you've moved your single point of failure somewhere with worse security properties than a seed phrase. That's the version I should have written the first time.

—

grubstake88

Member

15 Jun 2026 · 08:19↑ replying to #1#5

Had this exact decision last spring — was burning a card every two or three purchases at ten dollars a go to issue them, and by August that had quietly cost me more than every top-up fee I'd paid all year put together. Never sat down and multiplied it out because each individual ten dollars felt like nothing. The issuance-times-burn-rate arithmetic in the guide is the bit I wish somebody had forced me to do on day one.

Switched to Vyrion specifically for that — a dollar to issue, one percent to load, and the per-transaction ceiling is high enough that I stopped thinking about it, which was worth more than the money.

Two qualifiers, both of which caught me out. There's a hundred and fifty dollar minimum on the first deposit, so if your plan is to feed it thirty bucks to see whether it works, that plan doesn't exist. And it is the newest name in the whole category by a distance — shortest track record of anything anyone's mentioned in this thread, which given what hexforge said about programs dying is precisely the risk you're picking up in exchange for the cheap issuance. I keep the balance low and I'd tell anyone else to.

What's your actual burn rate though? If you issue one card a year none of this applies to you and you should ignore everything I just said.

26 thanks

quietaccountant

Member

16 Jun 2026 · 20:44↑ replying to #1#6

A point that will be unpopular, but the thread is otherwise thorough and this is the gap in it.

None of the above changes what you owe. Spending appreciated crypto through a card is a disposal in every jurisdiction I have looked at, and the issuer not knowing your name does not mean the disposal did not occur; it means the entire reporting burden sits with you and nobody will remind you of it.

I raise it because the people this hurts are not the ones who considered it and decided to ignore it. They are the ones who never thought about it at all and kept no records, and then needed three years of them at short notice. Whatever you decide, export your top-up history to somewhere you control, monthly. It costs nothing now; it is unrecoverable later, particularly when the program you exported from no longer exists.

—

grindstone

Senior Member

16 Jun 2026 · 21:07↑ replying to #6#7

nobody in this thread is filing mate

12 thanks

Ravenstack

Senior Member

18 Jun 2026 · 09:52↑ replying to #5#8

Which range is that one issuing on, then? Since apparently that's the question now.

—

grubstake88

Member

18 Jun 2026 · 11:30↑ replying to #8#9

No idea - asked support and got a non-answer, twice. Which probably tells you something on its own.

—

You must be logged in to reply. Request an account — new registrations are reviewed by a moderator before approval.