Gnosis Pay has disclosed a data breach in the legacy system behind its branded Visa debit cards, exposing customer card details, home addresses and the cryptocurrency wallet addresses linked to their accounts. The company said customer funds were not affected.
Summary
- Gnosis Pay detected unauthorised access to the system behind its branded consumer cards on November 3 and disclosed the breach on November 6.
- Notifications reviewed by Cointelegraph listed full card numbers, expiry dates, CVV codes, names, home addresses and linked crypto wallet addresses, along with email addresses, phone numbers and nationalities. Some also listed IBAN and BIC banking details.
- Customer funds were not affected, and the company’s separate enterprise platform, which powers white-label card programmes for other businesses, was untouched.
- The affected consumer card system was already scheduled for retirement on December 20, 2026. Gnosis Pay has made 3D Secure verification mandatory for all online card payments until then.
- Gnosis Pay has not said how many customers were affected. It said every affected customer was emailed with details of the information taken from their account.
- The breach is the company’s second security incident this year, after a June exploit that drained about $1.5 million from Gnosis Pay accounts.
What was exposed
Gnosis Pay’s public disclosure, published on November 6, said only that the breach “resulted in the exposure of certain customer information” and did not list the categories of data involved. The detail came from the individual breach notices sent to affected customers, which Cointelegraph reviewed.
According to CoinDesk, the notices listed full payment card numbers, expiration dates and CVV codes, customer names and home addresses, and the cryptocurrency wallet addresses linked to each account. Email addresses, phone numbers and nationalities were also listed, and in some cases banking details such as IBAN and BIC information.
The combination matters because a wallet address is public by design: anyone can look it up on a block explorer and see its balance and transaction history. What it normally lacks is a name. A record pairing wallet addresses with a person’s identity and home address supplies that missing piece, and the pairing stays valid for as long as the wallet is in use.
A cardholder’s notice made it public
Lefteris Karapetsas, founder of crypto portfolio tracker Rotki, shared the breach notice he received on X. He said it listed his name, full home address, card number and every wallet address linked to his account.
“You had already lost me as a user but you could have at least protected my data,” he wrote, CoinDesk reported.
Gnosis Pay confirmed the breach in its own post on X:
Cards shut down on December 20
The affected system runs Gnosis Pay’s consumer business: Visa debit cards sold under its own name that let customers spend stablecoins from self-custodial wallets. The cards are issued by Monavate, an e-money firm authorised by the UK’s Financial Conduct Authority.
The shutdown was planned before the breach. A notice issued on September 21 set the end of branded card services for 23:59 UTC on December 20, 2026, as the company shifts to its enterprise platform. Gnosis Pay said it replaced the compromised credentials, fixed the vulnerability and made 3D Secure mandatory for all online card payments until the system retires. It said it has reported the breach to its partners and is in contact with the applicable data protection authorities and its card issuer.
After December 20, a leaked card number belongs to a card that no longer works. The rest of the leaked record does not lapse with the card. Gnosis Pay’s own support guidance says transactions on Gnosis Chain remain permanently visible, so a wallet address tied to a name and home address stays useful to an attacker for as long as that wallet is in use.
What cardholders should do
Gnosis Pay told customers to check the email it sent them, which lists exactly what was taken from their account, and to freeze the card from the app if its number was listed. It said it will keep handling disputes and chargebacks until May 24, 2028, long after the cards stop working.
The company also warned customers to expect phishing attempts using the stolen details. It said neither it nor its partner apps will ask for a seed phrase, private keys, PIN or full card number, or ask customers to re-verify their identity by email or text. It added that there is no deadline for withdrawing self-custodied funds, so any message tying a transfer to the December 20 shutdown is false.
Second incident this year
In June, attackers exploited a flaw in wallet software modules used by Gnosis Pay accounts and extracted about $1.5 million. Gnosis absorbed those losses and restored user funds, according to its post-mortem.
What remains unknown about the November breach is how many customers were affected, when the intrusion began — November 3 is only the date it was detected — and whether the stolen data has been used in scams. Gnosis Pay said it has arranged specialist monitoring for signs that the data is being misused.
