Gnosis Pay, which offers a crypto-linked Visa debit card, said attackers gained unauthorised access to the legacy system behind its own branded cards, exposing customer information. The company detected the intrusion on Nov. 3, 2026, and disclosed it on Friday, Nov. 6. It said customer funds were not affected and that its enterprise platform for partner apps was outside the breach. It has not said how many customers were hit.
What Gnosis Pay disclosed
In its breach notice, Gnosis Pay said its monitoring systems “detected unauthorised access to the system powering Gnosis Pay-branded cards (our B2C business line), resulting in the exposure of certain customer information.” It said containment began within two hours of detection. After that, it replaced the affected security credentials and fixed the vulnerability.
The company said the breach was confined to the consumer card system. That system was already set to be retired on Dec. 20, 2026. Gnosis Pay said its enterprise platform, which runs all of its white-label card programmes, “was not affected.”
The notice does not name an attacker, describe how access was gained or name any outside vendor. It also gives no count of affected customers and no list of the data that was taken. Gnosis Pay said it emailed every affected customer on Friday “with exactly what information was taken from their account.” It also said it told partners about the breach and is in contact with data protection authorities and its card issuer.
What the customer emails showed
The fuller picture of what leaked comes from individual notices, not the public post. According to breach notifications reviewed by Cointelegraph, the exposed information included full card numbers, expiry dates, CVV codes, names, home addresses and wallet addresses linked to affected accounts. The same review found email addresses, phone numbers and nationalities, and in some cases IBAN and BIC banking details. Cointelegraph said one notification confirmed the customer’s card was cancelled on Nov. 3, with no suspicious transactions or movement of funds detected.
Those fields were not the same for everyone. Gnosis Pay said in a reply to a user: “The data types involved varied by customer. We sent customised notices to each person by email.” In another reply, the company said: “All potentially affected cards were blocked immediately and those customers were notified about that on the 3rd.”
The public statements do not explain how the Nov. 3 notifications relate to the Friday emails. They do not establish whether these were separate notices or groups of customers. Customers should consult their individual notice for the data involved.
Physical-security risks from exposed addresses
A leaked card number can be cancelled and replaced, and Gnosis Pay said affected cards were blocked. A home address tied to a list of wallet addresses cannot be reissued. Someone holding both may be able to link public on-chain balances to a physical location. This creates a potential targeting risk, a concern discussed in our coverage of France’s wave of crypto kidnappings. The sources reviewed do not establish any physical attack resulting from this Gnosis Pay breach.
The company’s own advice reflects this. It told customers to be careful “who you share your address or details of your crypto holdings with, online and offline.” It also said it is arranging specialist monitoring for any sign the stolen information is misused.
Hardware wallet maker Trezor went through a similar episode when it said its fulfilment partner ShipMonk kept customer data it had promised to delete. Trezor said its systems were not compromised and its devices remained secure. The comparison concerns exposed customer data, not proof that no funds ever moved.
Security changes and phishing warnings
Gnosis Pay said it has increased monitoring of card activity and wallets to catch fraud or attempts to reach user funds. It has also made 3D Secure verification mandatory for all online card payments. Those measures will stay in place until the consumer system is retired on Dec. 20.
The company warned that follow-up scams may use real personal or purchase details to look convincing. It said neither it nor its partner apps will ask for a seed phrase, private keys, a PIN or a full card number. They will also not ask users to “re-verify” their identity by email or text or to move funds over email, text or phone. Customers should go directly to the official Gnosis Pay web app or their partner app rather than following links.
A system already on its way out
Gnosis Pay said the Dec. 20 retirement was already scheduled before the breach. Its assessment that the enterprise platform was unaffected distinguishes the consumer-card incident from its partner business.
At our Saturday check, the blog still carried the Nov. 6 notice with no visible correction or expanded data list. The affected-customer count remained undisclosed. Cointelegraph said the company did not immediately respond to its request for comment.
Card issuing for the Gnosis Pay debit card is handled by Monavate Limited under licence from Visa Europe, according to the company’s website. Gnosis Pay has not attributed the breach to its issuer or to any other third party.
FAQ
Were Gnosis Pay customers’ funds stolen? Gnosis Pay said funds were not affected; we have not independently verified that assessment. It said potentially affected cards were blocked and that it has increased monitoring of card activity and wallets.
What data was exposed? The company’s public notice does not list the data. Emails reviewed by Cointelegraph listed items such as card numbers, CVVs, home addresses and wallet addresses, and Gnosis Pay said the data types varied by customer.
Are partner-app cards affected? Gnosis Pay said its enterprise platform, which powers white-label partner card programmes, was not affected. The breach was limited to the legacy system behind Gnosis Pay-branded cards.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
