On 6 November 2026, Gnosis Pay disclosed a breach of the legacy system behind its branded Visa debit cards. Monitoring had picked up unauthorised access three days earlier, on 3 November, and containment began within two hours. The company said customer funds were not affected. No victim count was given. The public statement named no data categories, saying only that certain customer information had been exposed. What was taken appears in the individual notices sent to affected customers, reviewed by Cointelegraph and reported by CoinDesk: full payment card numbers, expiry dates, CVV codes, names, home addresses, linked cryptocurrency wallet addresses, email addresses, phone numbers and nationalities, with IBAN and BIC banking details in some cases.
What the company disclosed
The cards are Visa debit cards sold under the Gnosis Pay name. They let customers spend stablecoins from self-custodial wallets. CoinDesk reported that the company was unveiled in 2023. The cards are issued by Monavate, an e-money firm authorised by the UK Financial Conduct Authority, according to the formal notice Gnosis Pay issued to cardholders on 21 September 2026.
The access hit the system that powers the branded cards, the company's consumer business line. Detection came on 3 November 2026. The security team moved at once, and containment began within two hours. Gnosis Pay said the affected security credentials were replaced and the vulnerability addressed, and the full statement is on the company's own blog. Decrypt covered the breach on 6 November 2026, the day Gnosis Pay disclosed it. Nothing outside the consumer system was affected.
The 20 December 2026 retirement was set before the breach. A notice issued on 21 September 2026 ended branded card services at 23:59 UTC that day. The enterprise platform, which powers white-label card programmes for other businesses, was not affected, and Gnosis Pay said it told its partners about the breach. It is also communicating with the applicable data protection authorities and with its card issuer. The authorities were not named. Monitoring of card activity and wallets was increased, to catch fraud or attempts to reach user funds. Specialist monitoring was arranged for any sign that the stolen information is misused.
Data in the breach notifications
The disclosure gave no list of data. It said only that the breach "resulted in the exposure of certain customer information". Cointelegraph and CoinDesk reported the categories from the breach notices sent to affected customers. The list describes what the reviewed notices contained. No claim follows that every affected customer lost every field.
The notices reviewed by Cointelegraph listed full payment card numbers, expiry dates and CVV codes. They also listed customer names, home addresses and the cryptocurrency wallet addresses linked to each account. Email addresses, phone numbers and nationalities appeared too. Some notices added banking details such as IBAN and BIC information. CoinDesk reported the same categories from the notices it saw.
No victim count has been disclosed. Cointelegraph cited third-party tracking data that put Gnosis Pay at roughly 2,400 daily active cardholders, processing about $263,200 over the previous 24 hours. The figure measures the platform's active user base, not the number of victims. CoinDesk cited Paymentscan data for annualised payments volume of around $67.6 million. Neither number says how many accounts the breach reached.
Wallet addresses and identity
Wallet addresses are public by design. A block explorer shows the balance and transaction history of any wallet address. The address on its own carries no name. Pair it with a name, a home address, an email address and a phone number, and the missing piece is supplied. That pairing stays valid for as long as the wallet is in use. Attackers could use the stolen data to connect users' real-world identities with their crypto holdings, and CoinDesk reported that the breach raises the risk of targeted scams on that basis.
The email addresses in the notices reviewed by Cointelegraph carry the same risk in a different form. They sit alongside names, home addresses and card numbers. An attacker with those contact details and personal facts can make a fraudulent message look real. Gnosis Pay warned customers to expect phishing attempts. The checks that apply when a message arrives carrying real personal details are covered in guidance on how to check if an email is phishing.
The cardholder notice
One November notice has been made public. Its recipient, Lefteris Karapetsas, shared it on X. Karapetsas is the founder of Rotki, a crypto portfolio tracker. The notice listed his name, full home address, card number and every wallet address linked to his account, according to CoinDesk. His reply read:
"You had already lost me as a user but you could have at least protected my data."
Cointelegraph reviewed one notification that confirmed the customer's card was cancelled on 3 November. No suspicious transactions or movement of funds were detected in that case. The confirmation covers one customer only. Gnosis Pay has not said that every affected card was cancelled on the same day.
Every affected customer was emailed on 6 November, Gnosis Pay said, with exactly what information was taken from their account. That email is the authoritative record. A customer who received no such email has no confirmation from the company that their account was affected. A breach lookup service such as Have I Been Pwned lets anyone check whether their address appears in a known breach.
What Gnosis Pay told customers
All online card payments now need 3D Secure verification until the consumer system retires on 20 December 2026, and fraud monitoring was increased too. A leaked card number belongs to a card that stops working after 20 December, so that part of the exposure ends on a fixed date. Gnosis Chain is a public blockchain, so transactions linked to a wallet address remain visible on it.
Support for refunds, disputes and chargebacks ends at 23:59 UTC on 12 June 2028, according to the formal notice Gnosis Pay issued to cardholders on 21 September 2026. The cards stop working long before that date. The notice sets no deadline for withdrawing self-custodied funds, so any message tying a transfer to the 20 December shutdown is false. The breach was confirmed by the company in its own post on X on 6 November:
"We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information. Everyone affected was sent an email today with full information. We deeply regret that this happened."
Measures for affected cardholders
Customers were told to check the email Gnosis Pay sent them, which lists exactly what was taken from their account. If the card number was listed, the card should be frozen from the app. Any unexpected email, text, call or letter about Gnosis Pay, a partner app or their card should be treated as suspicious, even if it includes real details or a real purchase, and its links should not be clicked. Customers were told to go to the official Gnosis Pay web app or their partner app directly.
Neither Gnosis Pay nor its partner apps will ask for a seed phrase, private keys, a PIN or a full card number, the company said. Re-verification of identity by email or text will not be requested. Customers will never be asked to move funds by email, text or phone. Account changes are only ever made inside the official Gnosis Pay web app or a partner app. Customers were advised to be careful who they share their address or details of their crypto holdings with, online and offline.
A separate risk faces cardholders who reused the exposed email address and password combination elsewhere. The breach notices reviewed by Cointelegraph listed email addresses. Credential stuffing works on reused credentials: stolen login pairs are tried against other services. That mechanism is described in how credential stuffing works. Changing a password on one service does not protect the others that share it, as does changing your password stop hackers explains.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Second incident in 2026
Gnosis Pay had a security incident earlier in 2026 too. In June, attackers exploited a flaw in wallet software modules used by Gnosis Pay accounts and extracted about $1.5 million. Gnosis covered those losses and restored customer funds, according to CoinDesk. The June incident took funds, while the November incident exposed information. The company has not stated that the two incidents share a cause.
The June incident took money from customer accounts, and Gnosis covered the losses and restored the funds, while the November incident exposed personal information, which a refund cannot reverse. A card number can be cancelled, and the card retires on 20 December 2026. The company has not said how long the stolen records will circulate.
Open questions
Three facts remain undisclosed. The number of affected customers is one. The intrusion start is another: 3 November is only the date of detection. Whether the stolen data has been used in scams is the third. Specialist monitoring for signs of misuse was arranged by the company, which did not immediately respond to Cointelegraph's request for comment.
No technical root cause was published either. The company said it addressed the vulnerability. The disclosure does not say what the vulnerability was or how the attacker got in. The attack vector is undisclosed, and no attribution has been reported. Until Gnosis Pay publishes more, the public record is the detection date, the notification list, and the measures the company has put in place before the system retires on 20 December.
Top comments (0)