If the public and private key pair no longer match then it would be possible to be able to encrypt a card number with the public key, but not decrypt it using the (wrong) private key. Since the key in the config file is used to generate an HMAC and encrypt the private RSA key, it's also possible (and more likely) that the key in /config/blesta.php was changed. This could have happened if Blesta was installed fresh, and the config file was overwritten with a previous one. That is likely what happened here.
If you don't have the original config file that was created when that RSA key pair was generated, then you're better off doing a fresh install. That key is used for encryption in other places as well, so I would highly suggest a fresh installation, especially since it is not production.