Gnosis Pay data breach exposes card and wallet details

Another crypto company has lost control of customer data rather than coins. The Gnosis Pay data breach, disclosed on November 6, hit the legacy system behind the company's own branded debit cards and exposed personal and payment details.

What happened

Gnosis Pay said its monitoring detected unauthorized access on November 3 and that containment began within two hours. It replaced the affected credentials, fixed the vulnerability and said its enterprise platform, which runs white-label card programs for partners, was not affected. The consumer system was already due to be retired on December 20, 2026.

The company did not say how many customers were hit. Cointelegraph, citing breach notices, reported that exposed data included full card numbers, expiry dates and CVV codes, names, home addresses, wallet addresses, email addresses, phone numbers, nationalities and, in some cases, IBAN and BIC banking details. One notice said the customer's card was cancelled on November 3 with no suspicious transactions.

Gnosis Pay has made 3D Secure verification mandatory for all online card payments until the legacy platform shuts, stepped up monitoring of card and wallet activity, and notified partners, its card issuer and data protection authorities. Decrypt reported that the company said on X it takes "full responsibility." Cointelegraph cited OpenRate data showing about 2,400 daily active cardholders and $263,200 in transactions over the prior 24 hours.

Rotki founder Lefteris Karapetsas publicly shared one of the notifications, Cointelegraph reported. Gnosis Pay said every affected user received an email listing the specific data taken, and that it has hired specialists to watch for misuse of the leaked records.

Why it matters

Crypto card users are an obvious target because a leak can tie a real name and home address to an on-chain wallet. That raises the risk of phishing and physical coercion, which is why Gnosis Pay urged users to guard their home address and avoid discussing their holdings. The Gnosis Pay data breach follows other recent leaks, including the Keystone data breach of hardware-wallet buyers and the Bithumb data breach.

For card programs, which sit between crypto wallets and the Visa network, the incident is also a regulatory issue. The cards are issued by Monavate under a Visa license, and European data protection rules give authorities room to investigate how the data was stored.

What's next

Affected customers should expect replacement cards and a wave of targeted scam attempts, since attackers now hold real names, addresses and purchase details that can make fake messages look convincing. The company stressed that legitimate staff will not request seed phrases, PINs or full card numbers, nor instruct anyone to transfer funds by phone or email.

The next questions are how many users were exposed and whether regulators open formal inquiries into the Gnosis Pay data breach. The company's account is on its official blog.