Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
The assessed payment path is the virtual Phantom debit card (Lead Bank prepaid Visa via Bridge), which Phantom's help centre says is available only in the United States, except New York. The Cash account itself is described as available worldwide, and Stripe funding is also offered in EU member states, but without the card there is no card payment rail. The Lead Bank cardholder agreement names no countries or states.
Conversion. The token is sold for fiat when a payment is authorised.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
CASH is a USD-pegged, fiat-reserve-backed stablecoin from Bridge and Phantom, classed here as platform because it is the provider's own-branded dollar. USDC, USDT or PYUSD sent to the Cash address on Solana are automatically swapped into CASH, so CASH is the only token the card debits. At payment Stripe/Bridge draws CASH from the Cash account and converts it to USD.
Checked 2026-10-12
Evidence (4)4 documented
DocumentedDrift
The debit card article says Stripe draws CASH from the Cash account at payment and converts it to USD.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better · 2 no evidence
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The bank and the program manager can block or cancel an individual card with or without notice. That meets anchor 0. No settlement contract was identified to assess further.
Evidence (1)1 documented
Documented
Lead Bank Prepaid Visa Cardholder Agreement (Bridge Ventures as Program Manager, Phantom as Platform Provider), fraud prevention clause.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Sanctions and geographic gating is disclosed in policy and help pages. It runs in closed services and cannot be bypassed (C2 = 0). 1.
Evidence (1)1 documented
Documented
The Privacy Policy says Phantom uses IP address and other data for sanctions compliance; the card is offered only in the US except New York after Link KYC, and some merchant categories are declined.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The token and chain are enumerated in docs (CASH on Solana). The issuer's powers are misstated: the FAQ says no partner can pull CASH out of a Cash account, but the mint carries a permanent delegate that can move or burn any holder's CASH, and a freeze authority. Solana has no sequencer, which is not stated either. Misstated, so 0.
Evidence (3)1 verified · 1 documented · 1 claimed
Verified
CASH mint (Token-2022, owner TokenzQdB...) has freezeAuthority AyCP3oW19DHZKvx8oU6mvseW2qn7XfmQ5STrXPa6prY5 and a permanentDelegate extension set to E7JdFMP5AqdndJKstZV2mHdekLwAQbNWRHMpoozyB3qw (both system-owned keypair accounts), which can freeze any CASH account and transfer or burn CASH from any holder.
checked 2026-10-07 · source unchanged at weekly re-read 2026-10-19
Claimed
The Cash FAQ answers "Can anyone pull CASH out of my Cash account?" with No, saying Phantom, Stripe, Link or any partner cannot access or withdraw funds.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
! Under review
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-12 7 days agoDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
Nothing needed to run Phantom Cash is public. 0.
Evidence (1)1 documented
DocumentedDrift
Cash runs in the closed Phantom mobile app (not the extension) and on partner services; no Cash, card or Cash-account program repository exists in github.com/phantom.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC is legally required and its basis is disclosed, but only in a hosted policy, and Phantom also keeps merchant location data for card transactions. Documented cap, so 1.
Evidence (1)1 documented
Documented
The Privacy Policy says KYC for opt-in features covers legal name, date of birth, SSN, government ID and contact data, processed by third parties under the Bank Secrecy Act; for Phantom Cash it also collects merchant location data and the last four digits of bank and card numbers.
What do calldata and events reveal about who paid whom for what? P3
! Under review
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-07 12 days agoDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
Each card payment is a public transfer from a long-lived Cash address, so amounts and timing are visible; merchant data is not onchain. Judgment call: this is "minimal linkage, documented" (2), but no sample transaction could be tied to the debit-card contract, so it rests on documentation and is capped at 1.
Evidence (1)1 documented
DocumentedDrift
The Privacy section says card payments appear onchain as transfers from the Cash account to Bridge's debit card smart contract, without merchant data, and bank flows as transfers to rotating Bridge wallets.
Who holds funds between payer and payee, and can the provider redirect them? S1
! Under review
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days agoDrift
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The weekly re-check found that a recorded fact changed. This rating counts as unknown until a reviewer re-checks it.
The balance is held as CASH in the user's Cash account, then moved to a Bridge contract when the card is used. Bridge is both CASH issuer and card program manager, and the CASH mint's permanent delegate lets it move any holder's CASH. Phantom's FAQ says no partner can. Judgment call: although the criteria put token-issuer powers under C5, here the issuer is also the card program manager and CASH is the only asset a Cash account holds, so "the provider can redirect funds" applies. 0.
Evidence (2)1 verified · 1 documented
Verified
CASH permanentDelegate = E7JdFMP5AqdndJKstZV2mHdekLwAQbNWRHMpoozyB3qw, a key controlled by the issuer side; Token-2022 lets a permanent delegate transfer or burn from any CASH account without the holder's signature.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Phantom wallet (private repository phantom/wallet): key derivation and storage, cryptography, deep links and WebViews, dependencies; the wallet that now hosts the Cash account. at 18c5d927b8 Initial review at aea4d38 (February to April 2024), verification at 18c5d92. The report predates the Cash account and debit card, and the closed-source app cannot be compared with the audited revision.
Unknown
No issues; 2 suggestions (BIP32 validation, stronger password key derivation), both resolved
Compiled from: phantom.com (Cash, security and legal pages), help.phantom.com, docs.phantom.com/cash, github.com/phantom (no Cash, card or Cash-account program code), usecash.xyz and bridge.xyz, Least Authority's published reports, and Halborn's audit listing. The only published report is Least Authority's 2024 audit of the Phantom wallet code; it predates Cash. Phantom said in 2022 that Halborn and OtterSec had audited the wallet, but no such report is published. No audit was found for the CASH token program set-up, the Bridge debit-card contract or Phantom's Cash backend. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 8 evidenced, 0 attested, 0 absent, 0 not applicable, 37 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
none
Virtual card issuance free; domestic US purchases free; no fee for loading the card or replacing it
Cash fees help article and Lead Bank cardholder agreement; the bank may change fees on notice.
fx
payer
International purchases "fees may apply", shown before confirming; no figure published
Cash fees help article.
provider
payer
0.85% on swaps out of Cash (except to USDC) and on non-stablecoin swaps into Cash; stablecoin swaps in free
Cash fees help article; Terms say fees may change without notice and are shown before confirming.
provider
payer
Funding: debit card 1.75%, credit card 3.50% (Stripe, US and EU); ACH deposit 0.30%; domestic wire 1.00%
Cash fees help article; banks and card partners may add their own fees.
cashout
payer
Standard ACH withdrawal free; fast ACH withdrawal 1.00 USD + 0.75% (min 1.50 USD)
Cash fees help article; US except New York.
network
payer
One-time Solana account setup fee when sending CASH to a wallet that has never held it (varies with SOL price)
Cash fees help article, described as a network requirement, not a Phantom fee.
limit
none
2,000 USD per card transaction; 2,000 USD per day (up to 5,000 after 30 days); money-transfer merchants 500 USD per week
Lead Bank cardholder agreement (per-transaction limit) and the debit card help article (daily and weekly limits).
Swap fees of 0.85% also cover swaps from the Cash account into other Solana stablecoins (USDT, USDG, PYUSD). Bridge's spread on the CASH-to-USD conversion at card payment is not stated; the card agreement says Bridge and Phantom conduct the stablecoin sale and refers fee questions to them.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12
Documented
Lead Bank Prepaid Visa Cardholder Agreement, transaction limitations; the help article "Use your virtual Phantom debit card" gives the daily and weekly limits.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
The user holds the keys to the Cash account, but the CASH mint's permanent delegate (issuer side, Bridge) can move or burn CASH from any holder and a freeze authority can freeze accounts; at payment Bridge draws CASH into its debit-card contract. Agrees with the S1 finding (score 0), which contradicts the FAQ's "self-custodial" statement.
FDIC (primary federal regulator); state charter, Missouri
State-chartered commercial bank, FDIC-insured, non-member (BKCLASS NM) · FDIC certificate 8283 Issuer of the Phantom debit card (Lead Bank Prepaid Visa); Kansas City, MO; active.
Only the issuer is register-checked. Phantom says it is not a bank and names no licence of its own. Bridge's footer says US services are provided by Bridge Building Inc. (NMLS ID 2450917); NMLS Consumer Access returned 403 to curl and was not bypassed, so that licence is not recorded. Card funds are not FDIC insured (cardholder agreement). The Cash help article updated in October 2026 says Stripe now issues the card and replacement cards are Stripe-issued, while the same page and phantom.com/cash still name Lead Bank; the issuer of replacement cards was not identified.
Documented
FDIC BankFind API record for certificate 8283, Lead Bank, Kansas City, Missouri; active, state charter, regulator FDIC, class NM.
Standard free; fast 1.00 USD + 0.75% (min 1.50 USD)
US except New York, KYC via Link; converted 1:1; to own or another person's linked US bank account.
everywhere offered
exchange
Kraken (the only exchange that accepts CASH on Solana per Phantom)
Solana network fees; exchange fees not recorded
No ATM cash-out; the card declines cash advances and ATM withdrawals, and the cardholder agreement bars cashback. Outside the US the Cash balance can only leave as CASH or swapped tokens to a Solana wallet.
DocumentedDrift
Debit card help article; declined merchant categories include cash advances and ATM withdrawals.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
No incident report for Phantom Cash or the debit card found. Searched status.phantom.com (no Cash component, empty history), the Cash help-centre section and the Phantom blog post list. The help centre's card-replacement wording (Stripe-issued replacement cards) gives no reason or date.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2025-09-30: Phantom Cash announced (waitlist; Lead Bank prepaid Visa via Bridge). source
2026-03-17: Terms of Use last updated (Phantom Cash and AI Agent sections). source
Undated change: help articles updated in October 2026 say Stripe issues the card and handles disputes, and refer to replacement Stripe-issued cards, while older text on the same pages names Lead Bank, Bridge and Galileo. Not entered as a dated change.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts. Card payments move CASH to Bridge's debit-card contract, whose address is not published and whose addresses rotate; the card settles over Visa on Lead Bank's closed ledger.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found for Phantom Technologies, Inc. on phantom.com/security, the Terms of Use, the Privacy Policy or the Cash help-centre section. Bridge, Stripe, Lead Bank and Galileo were not checked.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
Hosting provider and its certification are not named in any Phantom document read.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE report or statement found on phantom.com/security or in the legal pages.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Evidenced
Phantom publishes two third-party audit reports for its wallet (Kudelski Security 2021, Least Authority 2024) in github.com/phantom/audit-reports. Both predate Phantom Cash (announced 30 September 2025); no review covering the Cash backend, the Cash account or Bridge's debit-card contract was found. source 1 · source 2
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or letter found. Phantom runs a bug bounty on Cantina (up to 50,000 USD per the security page; security.txt Policy points at phantom.com/bug-bounty), which is not a penetration test.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No patch service levels found.
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No customer incident-notification commitment found in the Terms of Use, Privacy Policy or Cash help articles.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
The help centre's compromise article tells users to move funds to a new wallet and contact support; no service recovery plan found.
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Public status page at status.phantom.com (StatusPal) covering the extension, mobile app, backend, website and external dependencies; it has no Cash, card or bank-transfer component and showed no incident history on 2026-10-09. No post-mortems found. source 1
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Sign-in to the Phantom profile (and so the Cash account) is by Google or Apple account, recovery phrase or private key; on mobile the app is protected by device authentication such as Face ID or fingerprint. No separate second factor is described for Cash. source 1
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Unknown implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown
The Privacy Policy (last updated 7 July 2026) has no security or encryption section; no data classification or TLS statement found.
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Phantom keeps personal information as long as necessary for the purposes collected; no fixed periods. Phantom says it does not store KYC documents (Link does). Closing the Cash account (by request to support) deletes the virtual account numbers and closes the debit card, but Link's KYC data is not deleted and must be deleted at Link. See CROPS P2 for what is collected. source 1 · source 2 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
Phantom Technologies, Inc. publishes the policy; KYC data is processed by third-party service providers on Phantom's behalf, and Phantom says it may act as data controller for KYC only when sharing it with partners at the user's direction. GDPR lawful bases are listed for European users. No DPIA statement found. source 1
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No data processing agreement is published. The Europe section offers access, on request, to the safeguards used for international transfers (possibly redacted).
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown
Help pages describe the partner roles (Link KYC, Stripe funding and card, Bridge bank transfers and programme management, Lead Bank issuer, Galileo disputes); no architecture document found.
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Phantom Technologies, Inc. (Delaware corporation) under the Terms of Use and as Platform Provider for the card; the card agreement is with Lead Bank (Missouri state-chartered bank), with Bridge Ventures LLC (Delaware LLC) as Program Manager. Bank transfers run through Bridge; Stripe handles funding and, per a help article updated in October 2026, now issues replacement cards. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Customer fees (0.85% on most Cash swaps, onramp fees, fast-withdrawal fee; see fees) plus revenue shared by execution partners (searchers, validators, market makers) under the Terms. Phantom is a private company; no financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Phantom may terminate access at any time without notice; the bank may cancel or suspend the card at any time without prior notice except as law requires. On card closure the fiat balance is returned to the Phantom wallet as stablecoin (balances under 1 USD may be withheld). Closing the Cash account is permanent, by request to support; CASH stays in the user's Solana account, and Link KYC data is not deleted. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Unknown
The Privacy Policy describes fraud prevention using phone numbers, payment details, merchant location and wallet associations but does not say whether automated or AI systems decide. The Terms' AI Agent sections cover user-run agents, not Phantom's compliance.
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown implied from the component list
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Phantom mobile app and Cash account (Phantom profile sign-in)
wallet
No
proprietary
Phantom Technologies, Inc.
Yes
Phantom backend (prompt-free Cash swaps and transfers, card UI)
Bridge card programme and debit-card contract (program manager; draws CASH)
signer
No
proprietary
Bridge Ventures LLC (Stripe)
Yes
Lead Bank (card issuer)
card-issuer
No
proprietary
Lead Bank
Yes
Visa card network
card-network
No
proprietary
Visa
Yes
Galileo card processing and disputes
other
No
proprietary
Galileo
Yes
Link (Stripe) identity verification
kyc
No
proprietary
Stripe
Yes
Repositories
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no verified contract and no public repository needed to run the product, so type is incumbent. Searched 2026-10-07: phantom.com/cash, terms, privacy; help.phantom.com Cash section (FAQ, Understanding your Cash account, debit card, recovery, compromise, KYC); docs.phantom.com/cash; bridge.xyz Phantom card agreement; usecash.xyz; github.com/phantom (no Cash, card or Cash-account program). Onchain: the CASH mint (read above) and a sample of 60 recent CASH transactions, which use only SPL Token-2022, ATA, swap and prediction programs; no Squads or other smart-account program appeared, and the "self-custodial smart-contract wallet" and "debit-card smart contract" the help pages mention could not be identified. One candidate program, 99vQwtBw... (ExecuteTransfer with an ed25519 voucher), turned out to be a single-vault payout program unrelated to Cash accounts and was excluded. Re-assess as type card if Phantom or Bridge publishes the Cash account or debit-card program.
