The short version
A Soulbound transfer card lets you give stablecoins as easily as a gift card. You hand over a card number, and the recipient types it and an address into a public page. They need no account and no app, and there is nothing to connect or sign.
Unlike a gift card, every Soulbound transfer has a known sender and a signed purpose on the public record, while who received it stays private. Before anything is sent, four checks stop tokens going to an address that could never return them or that the token’s issuer has blocked.
Soulbound will never ask you to connect a wallet or sign anything to redeem a card. If a page does, it is not us.
A Soulbound transfer card works like a gift card for stablecoins. You load it with USDC or DAI (or ETH and WBTC), hand over the card number however you like, and the person receiving it types that number and an address into a public page. The tokens arrive shortly after. How It Works walks through it step by step.
Every other way of giving crypto to a person asks someone to take a risk. The recipient has to set up a wallet and share an address before you can give them anything. One wrong character sends tokens somewhere they can never come back from. Fake “claim” sites ask people to connect a wallet and approve something, then empty it. Fundraising pages get copied, or quietly edited to point somewhere else. This post explains how Soulbound removes each of those risks for the person giving, the person receiving and anyone asking for donations.
Better Than a Gift Card
A store gift card is easy to give, but it only works in one shop, and nothing about it records who bought it or why. That blank record is exactly why scammers ask their victims for gift cards.
A Soulbound transfer card keeps the ease and fixes the rest. The tokens go to any address the recipient chooses, so they aren’t locked to a shop or an app. Every transfer is created by a member with a Soulbound ID, and that ID and the transfer’s signed purpose are written to the blockchain, a public record that nobody can edit, including us. The card you hand over is built separately, off the blockchain, and its number is never linked to that record.
On the public record: Soulbound ID and the signed purpose of every transfer, and every request page with the ID that published it.
Kept private: the card itself, and who redeemed it. The sender’s deposit and the recipient’s delivery never appear in the same transaction.
Figure 1. How a Soulbound transfer card compares with the usual ways of giving someone money or crypto.
For Senders: A Known Sender and a Stated Purpose
Your Soulbound ID
When you first join, you claim a Soulbound ID. Think of it as a membership card that lives on the blockchain and is permanently tied to your wallet. There is one per wallet, and it can’t be sold, lent or handed to someone else. Claiming it records your acceptance of the platform’s rules, including your confirmation of where you are based, on the public record. It also has room for privacy-preserving identity checks, so members will be able to prove they have been verified without handing over personal details.
The rules, confirmed every time
Every sign-in is a fresh signature from your wallet that confirms the rules again. Each signature works only once, so it can’t be captured and reused, and your ID is only ever accepted from the wallet it belongs to. There are no passwords, reset emails or text-message codes anywhere on the platform, so there is nothing to phish or steal.
Every transfer says why it exists
When you create a transfer, your wallet signs a statement of its purpose, personal or charitable, and that statement is written to the public record with your Soulbound ID. Every transfer has a known sender and a stated reason, permanently.
Only you can open it
The card number is created and locked inside your own browser, with a key only your wallet can produce. Our servers keep a sealed copy that we cannot open. If you add the optional security code, it never appears on the card, so you can send the card one way and the code another, such as a text message and a phone call.
For Recipients: Nothing to Connect, Four Checks Before Anything Moves
To redeem a card, you need the card number, the security code if there is one, and an address to receive the tokens. That is all. There is no Soulbound ID to claim, no account, no app, and nothing to connect or sign.
That is the most important safety feature in the whole system. Scams that empty crypto wallets almost always start by getting you to connect a wallet and approve something. Redeeming a Soulbound card never involves either step, so any page that asks for one is fake.
With no wallet in the middle, there are no wallet warnings either, so we built the checks into the redeem page itself. Before anything is sent, four checks run in order:
Is it a real wallet? Some addresses can never send tokens back, such as a token’s own contract or a “burn” address used to destroy tokens. They are usually pasted by mistake from the wrong line of a website, and they are refused.
Has the token’s issuer blocked it? Some stablecoin issuers, such as Circle for USDC, keep a public blocklist on the blockchain. We check it live, for the token on the card, every time. Nothing is copied or guessed, and one issuer’s list never affects another token, so a DAI card isn’t touched by USDC’s list.
Will it actually arrive? We do a test run of the real delivery, at the real amount. If the address would reject it, the redemption is refused.
Can we check right now? If any check can’t run, the answer is no.
If any check says no, nothing moves. The card stays valid, the reason is shown in plain words, and you can redeem it to a different address straight away. Checking every address protects everyone else too, because deliveries go out in batches and one bad address could hold up a whole batch.
A few more protections work quietly in the background:
Each card pays out once. We tested it with twenty attempts to redeem the same card at the same instant. One went through and nineteen were refused.
Guessing doesn’t work. After a few wrong security codes, the card stops accepting guesses for a while, even if someone tries many at once.
Private by design. The recipient’s address is used once to deliver the tokens and is never kept.
For Requests: Donation Pages That Can’t Be Changed or Hijacked
A request page lets a person or a cause ask for donations. It is how our first campaign, with Mission 22, receives private donations, and How It Works shows how to publish one. Fundraising pages are a favourite target for impersonation, so request pages are the most locked-down thing a member can publish:
You can see who published it. Every request is created by a member with a Soulbound ID, and that ID is shown on the page and printed on its card.
It can’t be changed. Once a request is published, its address, title, description and links are frozen. Nobody can swap the address after people start giving.
Names can’t be redirected. If a request uses a name instead of an address, such as an ENS name, the name is looked up once when the page is published and the result is frozen. Changing the name later redirects nothing.
Only verified accounts. Requests can link only to social accounts we validate. Custom websites and campaign pages aren’t allowed, because that is where fake pages hide.
Every link leads home. The printable request card has no outside links. Its QR code and web address open only the request page on soulbound.finance.
Retype to confirm. Giving to a request fills in its address for you, and you type it again to confirm. The same four checks then run.
Cancelled, never erased. A cancelled request loses its QR code, but the page stays public as a permanent record.
Each request page also shows, live, how many Soulbound transfers its address has received, which is why we recommend a fresh address for each request. Deciding whether a cause is genuine is still up to you, but the page gives you a published ID, verified accounts and a permanent record to check, and nothing on it can send you anywhere else.
Five Habits That Cover the Rest
The platform handles the checks. The rest comes down to five habits:
Treat a card number like a gift card. Anyone holding it can redeem it.
Send the security code by a different route from the card.
Never connect a wallet or sign anything to redeem. Soulbound never asks.
Before giving to a request, check who published it and its verified accounts.
Never reveal a card number or security code while you are sharing your screen or letting an AI browser agent use your browser. Anything on the screen can be read and used.
Running Around the Clock
None of this lives only in a policy. The contracts behind it can’t be changed, and have run on Arbitrum, a network built on Ethereum, since 20 April 2026. Control of the platform needs three of four separate hardware keys, held in three countries. Real-time end-to-end testing and our red team create and redeem real cards against the live platform around the clock, and the delivery system was load-tested at 5,001 redemptions in a single run with zero failures. Activity is tracked independently on DefiLlama.
The core code is open source: sbf-protocol and SBA-Auth under AGPL-3.0, and Soulbound Points under MIT. If you find something, tell us at security@soulboundsecurity.io.
For a step-by-step walkthrough, see How It Works. To redeem a card, go to soulbound.finance/redeem.
This post replaces our earlier Security & Privacy Overview.
Soulbound Security is a blockchain security and technology company focused on protocol-level security infrastructure. We design and ship systems where privacy, compliance and auditability are architectural properties, not policy promises.