Hey all, Jason here.
Welcome to the first edition of Fintech Business Weekly in 2026. Grab a coffee, because it’s a long one.
I’m not going to lie, reporting out this story at this time — Silicon Valley VCs, stablecoins, rampant and obvious financial crime, and Venezuela — the last week has been a bit of a wild ride. I want to extend my thanks to everyone who took the time to speak with me for this story, especially those in Venezuela and in the Venezuelan diaspora.
To my friends in the mainstream media and trade press, I hope if you end up covering this that you’ll extend me the professional courtesy of citing my work.
If you make it through the next ~5,500 words and haven’t had your fill of sanctions-related content, you can check out Castellum.AI’s 2025 sanctions year in review report; it certainly helped provide me with some background context for my reporting.
Finally, if your email client clips this due to length, you can read the full version online here.
As global geopolitical conditions shift, so does the risk profile of individuals flagged across sanctions, PEP, and adverse media watchlists.
But many Fintech teams are still held back by inaccurate alerting and rigid workflows on high-risk individuals and transactions—impacting good and bad customers alike.
🗓️ Join us Tuesday, January 20th to see how risk & compliance teams are modernizing watchlist screening with built-in intelligence.
You’ll see a live walkthrough of a modern framework that speeds onboarding, shortens investigations, and supports confident decisioning.
Key takeaways:
Kontigo, a licensed crypto exchange in Venezuela, enables transactions with sanctioned entities in the country
The company is tied to the Maduro regime, including persistent rumors that the son of president Maduro is involved with the company
Investors in Kontigo include Coinbase Ventures, DST Global, Soma Capital, HF0, Alumni Ventures, Bayhouse Capital, and other institutional and individual investors
The company used numerous banking infrastructure providers to move funds, including JPMorgan Chase, Checkbook, Rain, Bridge, Lead Bank, and Stripe
Kontigo was purportedly the victim of a “hack” just days after the United States invaded Venezuela and captured its president
Y Combinator, the storied Silicon Valley accelerator once led by OpenAI chief Sam Altman, backed a Venezuelan company whose primary business model appears to be facilitating evasion of sanctions on Venezuela and arbitraging the exchange rate between Venezuelan bolívares and USD-linked stablecoins, specifically, Circle’s USDC.
As one Venezuelan national told me, the most profitable business in a country with currency and capital controls is buying dollars at the official rate and selling them at the informal market rate.
That’s the business Kontigo is in. The only catch is, to enjoy that very profitable privilege, you need to have the right connections.
Kontigo seems to have those connections. The company appears to have material links to recently deposed Venezuelan President Nicolás Maduro’s son, Nicolás Ernesto Maduro Guerra. The younger Maduro is named alongside his father and mother in the Department of Justice’s updated criminal indictment tied to the United States’ stunning invasion of the country on January 2nd.
Taking Kontigo’s bombastic cofounder and CEO Jesus Castillo at his word (which probably isn’t something you should do, but we’ll get to that later) business has been going well: he claimed in a September 2025 blog post that the company had grown from $1M in annualized revenue in June 2025 to $13M in annualized revenue by September 2025.
Castillo claimed the company was “executing toward $100M revenue by year-end,” a feat that anyone familiar with transaction-based revenue and retail neobanking business models — even those powered by stablecoins — would find wildly implausible.
To really understand the Kontigo story, you need to understand the recent history of Venezuela, its oil industry, and its relationship with the United States.
The Venezuelan government’s only meaningful source of revenue has long been oil.
Venezuela is not unique in being a resource-rich country that has come to depend on selling its resources abroad to obtain foreign currency — historically, primarily fiat US dollars — in order to pay to import the wide array of goods and services the country itself cannot or does not produce.
In fact, owing to the country’s longstanding mismanagement of fiscal and monetary policy and the severe inflation it has caused, at times, the country has been de facto “dollarized,” meaning that individuals and businesses were often using dollars to set prices and to transact, rather than the national currency, the bolívar.
But operating a dollarized economy requires having enough dollars in circulation.
Venezuela’s ability to access U.S. dollar currency has varied over time but generally has become more difficult as the United States has increased sanctions on the country:
Prior to 2015: Venezuela is not an OFAC program country. Sanctions are limited and primarily focused on individual designations (eg, for drug trafficking).
2015: President Obama issues Executive Order 13692, which leveraged the International Emergency Economic Powers Act (IEEPA) and the Venezuela Defense of Human Rights and Civil Society Act of 2014 to declare the country to be an “unusual and extraordinary threat to the national security and foreign policy of the United States” and authorized sanctions on persons determined to be involved in human rights abuses, corruption, or undermining democracy.
2017: President Trump issues Executive Order 13808 (later amended by Executive Order 13857 in 2019). E.O. 13808 specifically targeted securities and debt instruments issued by the Venezuelan government and PdVSA, the state-owned oil company. OFAC continues to expand the list of sanctioned politically-connected businesspersons by placing them on the Specially Designation Nationals (SDN) list.
2018: After Venezuela creates its own cryptocurrency, the “petro,” in an attempt to circumvent U.S. sanctions, President Trump issues Executive Order 13827, which sanctions any transactions in any digital currency issued by, for, or on behalf of the Venezuelan government (more on the petro cryptocurrency below.)
2018: Trump issues the more expansive Executive Order 13850, which blocked persons from operating in the gold sector of Venezuela’s economy and was later expanded to cover the country’s oil sector, effectively sanctioning the state oil company, PdVSA. The E.O. targeted gold as, with dwindling dollars available, gold became an important store of value locally and means of exchange with trading partners (Venezuela actually flew 127 tons of gold to Switzerland over a period of five years.)
2019: Trump issues Executive Orders 13884 and 13857, blocking the property of the Venezuelan government. E.O. 13884 blocked property interests of the Venezuelan government in the U.S. or in the control of U.S. persons, regardless of location, and prohibited U.S. persons from engaging in transactions directly or indirectly with the Venezuelan government — including entities 50% or more owned by the government. E.O. 13857 broadened the definition of “Government of Venezuela” to explicitly include the central bank, PdVSA, and “any person who has acted or purported to act directly or indirectly for or on behalf of” the central bank, PdVSA, or the Venezuelan government.
2021-2024: President Biden maintained the core sanctions, though his administration implemented minor adjustments and allowed some tailored licenses aimed at offering humanitarian relief. In the wake of Russia’s invasion of Ukraine, some oil industry-related restrictions were eased. But after what is widely regarded as Maduro’s illegitimate claim to reelection in 2024, much of this relief was rolled back.
2025: President Trump’s second term has seen minor tweaks to oil sector-related sanctions and, in December 2025, in advance of the United States’ invasion of the country, an expansion of SDN designations on individuals and networks associated with the state oil sector.
One doesn’t need to understand the specifics of each executive order to understand the impact on the Venezuelan financial system and economy: starting with Obama’s sanctions in 2015, with only minor deviations, it became progressively more difficult for the Venezuelan government, PdVSA, and any person or business affiliated with them to interact with the Western, dollar-denominated financial system.
The knock-on impacts of the resulting dollar scarcity and the country’s hyperinflation have devastated Venezuela’s economy and citizens.
Businesses struggled to find scarce foreign exchange to transact with the outside world (eg pay for imports), and both businesses and consumers are constantly searching for a store of value safe from the Venezuela’s persistent triple-digit inflation.
Venezuelans have been early adopters of all things crypto, owing to the instability of the bolívar and the extensive sanctions on the country.
And it isn’t only consumers or businesses that have leveraged crypto and stablecoins as a store of value or to more easily transact with the outside world.
Struggling with the impacts of U.S. sanctions, in 2017, then-President Maduro announced plans for a state-issued cryptocurrency, backed by the country’s vast oil wealth: the petro.
In 2018, as part of the legal and regulatory infrastructure for Maduro’s petro gambit, the country created a number of agencies, including the Venezuelan Cryptoasset Treasury (TCV) and the regulator in charge of the crypto sector, SUNACRIP.
The petro officially launched in 2018, with the Maduro regime initially planning to issue 100 million tokens at an initial value of $60 per petro.
However, petro more or less immediately ran into problems. While the government could mandate use in the public sector, the private sector and individuals were understandably skeptical — after all, if the government mismanaged the bolívar, what confidence could they have it wouldn’t do the same with the petro, radically devaluing it over time?
And ultimately, this did happen, with the Maduro government repeatedly changing the backing assets and arbitrarily adjusting reference pricing.
The U.S. also sanctioned the petro shortly after it launched, sharply limiting its usefulness as a mechanism for oil sales and international trade.
The petro struggled on until 2023, when an embezzlement and corruption scandal that came to be known as the PdVSA-crypto plot came to light. The short explanation of the scheme is that oil was sold, but, instead of the proceeds going to the public coffers, individuals connected to PdVSA, the state oil company, and SUNACRIP, the Venezuelan crypto regulator, stole the funds.
Estimates of the total value of public monies stolen in the scheme range from a low of $3 billion, the number calculated by the Venezuelan Public Prosecutor’s Office, to as much as $20 billion. Transparencia Venezuela put the number at just shy of $17 billion.
The scandal led to the arrests of at least 21 individuals. Tareck El Aissami, the Minister of Industry and National Production from 2018 to 2021, was a key player in the wide-reaching scheme.
Notably, SUNACRIP, the Venezuelan crypto regulator, also rolled up the the ministry headed by El Aissami.
In the wake of the PdVSA-crypto plot, the petro was sunset in early 2024.
SUNACRIP was suspended with the stated purpose of “restructuring” the agency. Anabel Pereira Fernández was appointed to chair the committee in charge of restructuring SUNACRIP.
Other principal directors of the restructuring board include Héctor Andrés, Obregón Pérez, Julio César Mora Sánchez, Román Daniel Maniglia Dar-wich and Larry Daniel Davoe Márquez, according to Transparencia Venezuela’s report on the scandal.
So how does Kontigo fit into all of this?
According to the cofounder and CEO Jesus Castillo’s LinkedIn, the company was founded in mid-2023.
Castillo himself is something of a serial entrepreneur. According to his personal website, he’s a three-time founder, primarily in technology, but he also started a specialty liquor brand, Casa Bicuye.
The oldest available archived version of Kontigo’s site, from December 2023, describes it as a digital SAN — a hybrid savings/credit structure common in many parts of the world also known as a rotating savings credit association, or ROSCA.
Versions of the site from early 2024 explicitly target Venezuelan consumers and similarly describe Kontigo as a SAN. The site emphasizes the ability to save in dollars in order for users to “say goodbye to inflation.” Kontigo also promised users they could earn an 18% return on their savings.
While this older iteration of Kontigo doesn’t explicitly mention stablecoins, that is presumably the mechanism the company used; how it purported to generate the outsized 18% return is unclear, but certainly involved putting users’ savings at risk.
But when Kontigo applied for and was accepted into the vaunted Silicon Valley accelerator program Y Combinator, it described itself as a “USDC-Smart Neobank for Latinos.” Y Combinator was cofounded by Paul Graham, was led by current OpenAI CEO Sam Altman from 2014 to 2019, and has been led by Garry Tan since January 2023.
Y Combinator’s standard terms for companies in its program are simple: YC, as it is commonly known, invests $500,000 for a 7% stake in the company.
The primary YC partner on the Kontigo investment is Tom Blomfield — if that name sounds familiar, it’s because he was the cofounder and CEO of British digital bank Monzo.
Blomfield stepped down from the CEO role at Monzo during the early days of the COVID-19 pandemic because of what he described at the time as “burnout.”
He ultimately left the U.K. bank best known for its hot coral debit cards in January 2021. Blomfield joined Y Combinator as a visiting partner in September 2021 and became a general partner in April 2023.
Blomfield, Y Combinator, and YC chief Garry Tan did not respond to repeated outreach via email, LinkedIn, and X or questions about their support of and investment in Kontigo for this story.
Kontigo was in YC’s Summer 2024 cohort and presented at the accelerator’s “demo day,” where program participants pitch prospective investors, in late September 2024.
YC cohorts typically last three months. Per Castillo’s social media posts, Kontigo’s first day at YC was on July 16th, where he and his cofounder watched a fireside chat between two YC alums: Stripe cofounder and CEO Patrick Collison and former Stripe CTO and OpenAI cofounder and President Greg Brockman. Castillo even tagged the two Silicon Valley stalwarts in a picture he posted from the event.
Kontigo would later come to work with both Stripe and its recently acquired stablecoin infrastructure subsidiary, Bridge.
Exactly when, how, and why Kontigo transitioned from an aspiring neobank to what it ultimately has become — functioning as arm of the Venezuelan state for injecting USD stablecoin liquidity derived primarily from selling oil to China — remains hazy.
Although Kontigo announced less than a month ago that it had raised a “$20 million seed round,” sources familiar with the company indicated that the fundraising happened quite a while ago, most likely following its September 2024 Y Combinator “Demo Day” presentation.
In fact, Castillo tweeted in December 2024 that the company raised a $4 million seed round and that key team members had secured their American O-1 visas to move to San Francisco to work on building and scaling the company.
Kontigo’s exact capabilities and positioning continued to evolve over time. By January 2025, the company was enabling Venezuelans to buy USDC using bolívares — thereby protecting their purchasing power from the country’s highly unstable currency.
Castillo demonstrates how Venezuelan users can hold a balance in Kontigo in USDC and relatively easily convert into bolívares for local spending in this January 2025 Tiktok video.
In the video, Castillo demonstrates off-ramping funds held as USDC in Kontigo to bolívares in Banco de Venezuela — a bank explicitly sanctioned under President Trump’s Executive Order 13850:
Being able to move between USDC and Venezuelan bolívares digitally and easily was already quite an unusual achievement, considering that SUNACRIP, the country’s crypto regulator, had been defunct and undergoing “reorganization” following the PdVSA-crypto scandal.
With a lack of centralized exchanges in the country, much of the crypto ecosystem in Venezuela was peer-to-peer, with platforms like Binance operating a marketplace to match buyers and sellers of crypto and bolívares, rather than operating as a centralized exchange in the country.
But on May 12, 2025, Kontigo announced something truly astounding, given the heavy and complex sanctions on the country: the ability for Venezuelans to open free “virtual” accounts at JPMorgan Chase in order to move money from external platforms like Payoneer, Upwork, Wise, Venmo, Deel, Airbnb, and Onlyfans through the $4.6 trillion asset bank and into USDC held at Kontigo:
The company and Castillo were not, exactly, subtle about promoting this capability. Kontigo itself promoted this new capability heavily on social media, and presumably happy (or perhaps compensated) customers spread the word by sharing enthusiastic explainer videos like these.
It wasn’t just consumers, either. Kontigo expanded to target Venezuelan businesses with its offering, though Castillo’s LinkedIn post more discretely describes the offering as being for “SMBs in LatAm.”
Given the nature of doing business in Venezuela, offering banking services to these entities is even more challenging and higher-risk from a U.S. financial crimes compliance standpoint.
At one point, Kontigo’s website even claimed to offer a corporate account “in partnership with J.P. Morgan & Chase Bank,” according to archived versions of the site.
Equally unexpectedly, Kontigo offered virtual Visa cards that could be loaded from the USDC users hold in their accounts. Fintech Business Weekly was able to test and successfully load $5 from a Kontigo USDC balance onto what the company describes as its “Kontigo Cash” Visa card.
The card Fintech Business Weekly was able to test did request CIP information, and the identity information used was not from Venezuela, any other high-risk jurisdiction, or the United States.
The card Kontigo created based on the submitted CIP information was issued by Rain, a popular crypto-cards-as-a-service startup that announced on Friday it has raised a $250 million Series C.
Rain, legally known as Signify Holdings Inc., in turn operates Nimbus LLC, a Puerto Rico-licensed money transmitter that sometimes does business using the name Third National.
Rain appears to have shut down Kontigo’s card program just hours after being contacted by Fintech Business Weekly regarding Rain’s relationship with the company.
A Rain spokesperson declined to provide a comment for publication.
Kontigo was able to pull off the unlikely feat of offering JPMorgan Chase virtual account credentials by leveraging a third-party partner of the bank: a little known startup called Checkbook. This detail was first reported by The Information’s Michael Roddan and Yueqi Yang last Decemeber.
JPMorgan’s own website describes virtual accounts as a way to “streamline” account structures and cash management processes, while offering the ability to “improve transparency into counterparty payments.”
Checkbook’s developer documentation provides some insight into how Kontigo and another Y Combinator startup mentioned in The Information’s story, stablecoin API provider Blindpay, were able to generate Chase virtual accounts — seemingly without the bank’s knowledge or approval.
While Checkbook’s primary use case is, as its name would suggest, replacing the use of physical checks, it also offers a “wallet” capability:
One of the use cases described on Checkbook’s website is for “marketplaces,” which Checkbook describes as “an embedded product, which allows customers [of Checkbook] to facilitate transactions to, or on behalf of users and customers.”
Checkbook gives examples like gig work platforms, earned wage access services, bill pay, rent disbursement, and cross border/remittance payments.
Additional documentation on the process of creating a wallet for a “marketplace user” demonstrates how Checkbook created JPMorgan Chase virtual account credentials on behalf of end users of of Kontigo — most of whom appear to be consumers and businesses in Venezuela, a higher-risk jurisdiction avoided by substantially all American banks.
The Information reported that elevated rates of ACH disputes and reversals led “JPMorgan and Checkbook” to freeze Blindpay’s accounts in August 2025, shortly after it published a since-deleted blog post saying it was “harder than it should be” to get access to a U.S. bank account.
A representative for Blindpay confirmed to Fintech Business Weekly that the company offers named virtual accounts through Checkbook, which uses JPMorgan Chase as its banking partner, and that the accounts remain active.
The spokesperson said that a temporary restriction in August was operational in nature and related to elevated ACH returns, not financial crime or sanctions risk, and that normal operations were restored 20 days later.
While Blindpay seems to have come to JPMorgan Chase’s attention in August 2025, the bank appears not to have notice the bigger risk, Kontigo.
In September 2025, the month after Blindpay’s issues with Checkbook and its bank partner, Kontigo claimed to hit $10 million in annualized revenue and to have processed $250 million in volume in the preceding three months.
But on November 21, 2025, Kontigo announced that its “American accounts provider” (JPMorgan Chase via Checkbook) had requested a “temporary” service pause, which was reported in Spanish-language media and drove questions in the r/AskVenezuela subreddit about what had happened.
Kontigo CEO Castillo told The Information that Kontigo also works with Bridge, owned by fellow Y Combinator alum Stripe, to offer virtual accounts in the United States.
Fintech Business Weekly independently confirmed Kontigo works with Bridge, the stablecoin infrastructure company that Stripe acquired in early 2025 for $1.1 billion.
Bridge works with Lead Bank, a popular choice among crypto and stablecoin firms, to move funds from U.S. dollar currency into stablecoins such as USDC used by Kontigo. A source familiar with the relationship between Kontigo and Bridge said that Bridge is working to offboard the company.
Asked how these kinds of multilayered infrastructure relationships make financial crimes compliance challenging, AML/sanctions expert and President of Palmera Consulting Sarah Beth Felix told Fintech Business Weekly, “These ‘layers’ like Bridge have many ramps, products, customer types, payment flows, and aspects to their relationships. Meaning, the entirety of AML is not wholly applied across every cent or customer due to the layered responsibility and applicability.”
Representatives for JPMorgan Chase, Checkbook, Stripe/Bridge, and Lead Bank didn’t respond or declined to provide comment for publication.
Cryptocurrencies, including stablecoins, are deployed by a number of state actors subject to sanction and those looking to transact with them, including countries like Russia, Iran, and China.
Chainalysis’ head of national security intelligence, Andrew Fierman, told Fintech Business Weekly, “Today, crypto activity in Venezuela mirrors what we observe in other heavily sanctioned environments. Digital assets can be leveraged to bypass the traditional financial system, including through the use of stablecoins in oil trading and other state-linked activity.”
This gives context to last October’s New York Times reporting that “Venezuela today sells the bulk of its oil to China, gets paid in crypto and then funnels some of those revenues back into the national economy.”
The article continued, saying, “This year [2025], the government started funneling part of its oil revenues into the economy through the two authorized crypto exchanges, which are allowed to trade bolívares at a weaker exchange rate.” (emphasis added)
One of those exchanges is Crixto Venezuela C.A., which operates under the name Crixto (the site you’re served may vary based on geolocation) and through its iOS and Android apps, CrixtoPay.
Crixto isn’t making an effort to disguise what it’s doing. It obtained a licensed from Venezuelan crypto regulator SUNACRIP dated January 9, 2025, and signed by Anabel Pereira Fernández, the chair of the committee in charge of reorganizing SUNACRIP.
Despite Fernández holding that position for more than a year, it appears SUNACRIP never officially became operational again.
Kontigo is the second authorized exchange, though the company has made slipshod efforts to create some distance between its current U.S.-facing entity, Kontigo, Inc., and the entity that holds the SUNACRIP license, Oha Technology, C.A.
Oha Technology, C.A., was granted a license by SUNACRIP — also on January 9, 2025.
An archived version of Kontigo’s website explicitly links the two, with a disclosure stating that Kontigo, Inc. — a Delaware corporation that, presumably, is the entity in which Y Combinator, Coinbase Ventures, DST Global, Soma Capital, HF0, Alumni Ventures, Bayhouse Capital, and others hold equity — is represented by its subsidiary and brand representative, Oha Technology, C.A.
The footer disclosure was subsequently removed, but there are plenty of other data points linking Oha Technology to Kontigo. Kontigo CEO Castillo’s LinkedIn profile and personal website mention a company he previously founded, Oha AI.
And then there’s the video of Castillo, posted on Kontigo’s official Tiktok account, describing the company as “authorized in Venezuela” with an image of Oha’s SUNACRIP license appearing behind him:
Sources familiar with the situation in Venezuela explained to Fintech Business Weekly that SUNACRIP, which was part of the Ministry of Industry and Natural Production during the petro days leading to the PdVSA-crypto corruption scandal, is now part of the Venezuelan banking regulator, SUDEBAN, but that SUNACRIP never officially reopened.
How did Kontigo/Oha Technology obtain one of two licenses from a seemingly defunct regulator?
About a dozen sources Fintech Business Weekly spoke with — including people on the ground in Venezuela, Venezuelan expats, and even American banking execs — repeated the same rumor: Nicolás Maduro’s son, Nicolás Ernesto Maduro Guerra. Multiple sources described the younger Maduro, who was indicted in the United States alongside his parents on drug trafficking conspiracy charges, as being “behind” or “the ultimate beneficiary” of Kontigo’s scheme.
Sources also pointed to other admittedly anecdotal and circumstantial evidence: that, on his Instagram, the younger Maduro follows Kontigo cofounder Camilo Sanchez, the Kontigo Instagram account, and the account of Bicuye, the agave spirits company started by Castillo.
Kontigo’s logo also appears to intentionally incorporate that of petro’s, the Venezuelan government’s own failed crypto attempt.
Again, hardly conclusive and could be more charitably read as a marketing tactic by Kontigo — but presumably not something a company looking to distance itself from a corrupt regime and the $17 billion crypto scandal tied to petro would do.
Recall that, with its capital and currency controls, one of if not the best way to make money in Venezuela is buying dollars — or dollar-pegged stablecoins — at the official, government-set exchange rate and selling them at the informal rate.
The October New York Times piece, which appears to reference Kontigo and Crixto without naming them, said they were “allowed to trade bolívares at a weaker exchange rate,” while, at the same time, competitor apps were forced to shutdown for engaging in the “parallel dollar” market.
A report from Transparencia Venezuela claims to document the exchange rate difference, with Kontigo and whoever is behind it ultimately profiting from the arbitrage.
Fintech Business Weekly has independently verified the exchange rate Kontigo offers deviates substantially from the official exchange rate.
According to the Venezuelan central bank, the official exchange rate is approximately 330 bolívares to the dollar. Yet, a user attempting to buy (deposit) 1 USDC via Kontigo would pay 540 bolívares — meaning, if Kontigo is buying at the official rate and selling at this rate, it’s making a 210 bolívar profit on every 1 USDC.
The company can then take the bolívares users swap for USDC, purchase additional USDC at the “official” rate, rinse and repeat.
This business model helps explain the explosive growth numbers Kontigo claims to have achieved. The company’s website claims to have over $1 billion in total payment volume (TPV) and more than 1 million monthly active users.
However, analysis of Kontigo’s public wallet, which the company encourages users to “audit,” shows only $93 million of inflows on the ethereum blockchain and $190.6 million of inflows on Coinbase’s Base blockchain.
That Kontigo wallet currently holds just $360,000 of USDC on Base and $154,000 of USDT (Tether) on ethereum.
Sources familiar with Kontigo’s business practices told Fintech Business Weekly that the TPV metric is inflated by Kontigo counting funds in and funds out, that the monthly active “users” metric is measuring wallets, and that the lion’s share of the activity came from Kontigo’s relationship with the Venezuelan government.
Those sources suggested the company bought app installs in countries throughout LatAm, both to inflate its stats but also to make it appear that the company’s user base wasn’t so heavily concentrated in Venezuela.
Industry analysts also pointed out the company’s “take rate,” or stated revenue as a percent of its stated payments volume, is unrealistically high, given the business it claims to be in.
Last week, in the wake of United States’ invasion of Venezuela and capture of President Maduro, Kontigo announced that it had been “hacked.”
A post on the company’s social media said that $340,905.28 worth of USDC had been stolen from at least 1,005 users, in an apparent mass account takeover scheme; the company said that it reimbursed impacted users.
However, the day of the purported “hack,” approximately $5 million worth of USDC flows out of and back into Kontigo’s publicly known wallet. The company has not acknowledged or explained this unusual activity.
After the hack, Castillo, the Kontigo CEO, tweeted (translated from Spanish) “To the hackers: We know who you are, and you will not go unpunished.”
Kontigo blamed a third-party authentication provider and repeated the company’s marketing claim that its wallets are “self-custody.”
However, nowhere in the Kontigo app is a user able to view or access the private keys that correspond to their crypto holdings. Numerous experts Fintech Business Weekly consulted about the wallet structure repeated the crypto industry mantra “not your keys, not your crypto” and strongly disagreed with the “self-custody” characterization.
The availability of Kontigo’s service varied last week, apparently as the company attempted to manage the fallout of the hack, including what they say was a second hack attempt. At times, users couldn’t login to the app at all. When they could log in, at times, the user interface wouldn’t load and, when it did, options to withdraw USDC to bolívares or move USDC to an external wallet were disabled.
As of the time of publication, Kontigo’s functionality is impaired in at least some of the countries in which it operates.
On the U.S. side, Stripe’s subsidiary, Bridge, appears to have frozen the company’s ability to move funds, but Stripe itself is still processing payments for the company. A test transaction on a JPMorgan Chase-issued Visa card went through successfully late in the day yesterday:
Yet even Binance — Binance! — appears to be warning users not to transact with Kontigo-linked wallets. A message posted in a private Telegram group for Binance’s peer-to-peer users in LatAm said that, (translated) “Following internal risk and security policies, the use of Kontigo “Oha Techology” bank accounts in P2P market transactions is prohibited with immediate effect.”
The post continues to warn users that there will be penalties for non-compliance, including temporary suspensions and the removal of their “verified merchant badge.” It concludes by reminding users to (translated) “avoid transacting using banking entities sanctioned by international organizations or methods not listed as available payment methods on Binance P2P.”
JPMorgan Chase CEO Jamie Dimon recently cheekily commented on the bankruptcies of auto parts firm First Brands and subprime auto lender Tricolor Holdings by saying, “When you see one cockroach, there’s probably more.”
The same could be said about the burgeoning stablecoin space, which carries risks that have direct and obvious parallels to the banking-as-a-service model.
Like with BaaS, there is a goldrush mentality about stablecoins right now, from “infrastructure” players, like Bridge and bvnk, but also from a small number of banks that work with them.
The same kinds of third-, fourth-, n-th party risks exist in stablecoins as exist in the bank-fintech partnerships that preceded them. That Kontigo and Blindpay were able to move money through JPMorgan Chase for months via Checkbook without being detected demonstrates that even ostensibly sophisticated, large banks struggle to manage these risks effectively.
Sarah Beth Felix, the AML/sanctions expert, drew a similar parallel, saying, “Much like what we saw in 2023-2025 with the explosion of fiat fintech and their bank partners, too much reliance is placed on an entity registering as a [money services business]. Meaning, these large banks lookup on the FinCEN site that these [non-bank financial institution] firms are registered as an MSB and they get a false sense of security that this entity is ‘regulated’ like they are.”
There have been plenty of disasters in BaaS, but, with the notable exception of Synapse, “end users” have generally escaped unscathed.
Let’s hope that when — and, as Kontigo demonstrates, it likely is when — there is another disaster in the stablecoin space, it isn’t consumers who end up paying for it.
Kontigo and its cofounder/CEO, Jesus Castillo, did not respond to repeated outreach regarding this story by the time of publication.
Request for Information and Comment on Reserve Bank Payment Account Prototype (Federal Reserve Board of Governors)
Truth in Lending (Regulation Z); Non-application to Earned Wage Access Products (Consumer Financial Protection Bureau)
In the Shadow of Bank Runs: Lessons from the Silicon Valley Bank Failure and Its Impact on Stablecoins (FEDS Notes)
Banks in the Age of Stablecoins: Some Possible Implications for Deposits, Credit, and Financial Intermediation (FED Notes)
Presidentially-Connected Firms and the Importance of Regulatory Independence (Todd Phillips/Georgia State University)
Trump’s Call for 10% Credit-Card Cap Aims at Banks’ Crown Jewels (Bloomberg)
Jenius Bank employees say the bank is closing (Banking Dive)
Digital Asset Markup: What Will It Take to Get to Yes? (Todd Phillips/Open Frontier)
Bearer Bonds Missing In Action (Fintech Takes Banking)
Listen: A Look Back at 2025 and Ahead to 2026 (Fintech Recap)
Looking to work with me in any of the following areas? Email me.
Now available: buy my best-selling book, Banking as a Service: Opportunities, Challenges and Risks of New Banking Business Models, here
Vendor, partner & investment opportunity advice and due diligence
Fintech advising & consulting
Sponsoring this newsletter
News tip or story suggestion — reach me on Signal at mikulaja.01
Source link
