Gnosis Pay issues Visa debit cards that spend stablecoins straight from a customer's own crypto wallet. On Friday 6 November 2026 it disclosed that an intruder had reached the system behind its own-branded consumer cards. The company says it detected the unauthorised access on 3 November and began containing it within two hours. It says customer funds were not touched and its separate enterprise platform was not affected. It has not said how many customers were affected, and its public statement does not list what kinds of data were exposed. Breach notices shared by customers and reviewed by journalists go further. They describe names, home addresses, card numbers and every wallet address linked to the account. Cointelegraph reports that some notices also listed expiry dates, CVV codes and bank details. The result is a single file that ties a cardholder's identity and physical location to their on-chain holdings.
What Happened
According to the company's statement, quoted by PYMNTS, Bitcoin.com News and others: "On 3 November 2026, our monitoring systems detected unauthorised access to the system powering Gnosis Pay-branded cards (our B2C business line), resulting in the exposure of certain customer information." Gnosis Pay says containment began within two hours. It then replaced the affected security credentials and "addressed the vulnerability."
The company published its statement and emailed affected customers on 6 November, three days after detection. Crypto.news reports that Gnosis Pay said it had informed its partners and was communicating with "the applicable data protection authorities" and its card issuer. It has not named those regulators or said when they were notified. Coindaro points out that this matters under the GDPR's 72-hour notification rule. No regulator has published anything about the incident.
The breach became public mostly through a customer. Lefteris Karapetsas, founder of the crypto portfolio tracker Rotki, posted the notice he received on X. The Defiant reports that Gnosis Pay confirmed the breach publicly hours after his post. CoinDesk covered the story on 7 November.
The timing makes the incident worse. On 21 September, Gnosis Pay told cardholders it would retire its consumer cards on 20 December and focus on selling card programmes to other businesses. The Defiant notes that the breach came 47 days before that shutdown. The company says the breached system "was already scheduled for retirement." Gnosis Pay has also been attacked before. On 1 June an attacker exploited the delay module that protects Gnosis Pay accounts. Accounts of the losses differ: CoinDesk puts them at $1.5 million, while The Defiant cites the company's own post-mortem at about $1.8 million, which Gnosis covered.
Reaction from customers has been hostile. Crypto.news reports replies to the announcement asking what "taking full responsibility" means in practice. Some users raised fears of follow-up phishing and of physical attacks on known crypto holders. Others called for the service to shut down immediately.
What Was Taken
Number of victims: not disclosed. Gnosis Pay has given no figure. Third-party data gives a rough sense of scale but does not count affected customers: - Cointelegraph, citing tracker OpenRate, reports about 2,400 daily active cardholders and $263,200 in transactions over a 24-hour period. - CoinDesk, citing Paymentscan, puts annualised payment volume at about $67.6 million. - The Defiant counted from Gnosis Chain logs about 71,100 card accounts set up on the new account template in June after the exploit, 5,087 in July and 1,731 in October.
None of these figures should be read as the breach total.
Data types: accounts differ. Gnosis Pay's public statement lists no data fields. Coindaro re-checked the blog post on 7 November and found it still listed none. What is known comes from individual notices, and they do not all match: - Karapetsas's own post: full name, full home address, card number, and every wallet address linked to his account. - The Defiant, describing the same notice: name, home address, full card number with its security code, phone number, nationality and linked wallets. - Cointelegraph, citing notices it reviewed: full card numbers, expiry dates, CVV codes, names, home addresses, email addresses, phone numbers, nationalities, linked wallet addresses and, in some cases, IBAN and BIC bank details. ForkLog repeats this list, credited to Cointelegraph. - Protos, as cited by Coindaro: notices listing name, shipping address and an account reference.
ForkLog reports that the exposed data varied from account to account, which may explain much of the difference. Gnosis Pay has not confirmed that CVVs or expiry dates were exposed. Cointelegraph says the company did not respond to its request for comment. One notice reviewed by Cointelegraph said the customer's card had been cancelled on 3 November and that no suspicious transactions or fund movements had been found.
Sensitivity: high. The card data can be cancelled and reissued. The identity-to-wallet link cannot be undone.
Why It Matters
The Defiant sets out the core problem. A Gnosis Pay account is a Safe smart account on Gnosis Chain, and card payments settle on-chain. Anyone who knows a Safe's address can therefore read its full spending history and balance. Visa card issuers must still verify each customer's identity. Put together, that means Gnosis Pay held one dataset joining a legal name and home address to a public wallet. Leaking it hands attackers a list that already answers the questions criminals usually have to work out: who holds crypto, how much, and where they live.
That raises three separate risks:
- Targeted phishing. Gnosis Pay itself warned that scammers may use stolen personal details and purchase histories to make fraudulent messages look real. An email that quotes a victim's real wallet address and recent card purchases is very convincing.
- Physical coercion. Crypto holders have increasingly been targeted with home invasions and kidnappings aimed at forcing wallet transfers. A list of verified holders with home addresses and visible on-chain balances is exactly the targeting data those crews need. Customers raised this fear directly in replies to the company.
- Card fraud. If the reports of full card numbers with CVVs and expiry dates are accurate, the cards could be used for card-not-present fraud. Gnosis Pay's move to mandatory 3D Secure and reports of cards being cancelled reduce this risk but do not remove it.
For defenders more broadly, this is a familiar failure on a system being wound down. The breached platform was scheduled for retirement, yet it still held complete identity and payment records for its whole customer base. Systems on their way out tend to get less security attention while keeping all of their sensitive data.
The Attack Technique
Little is known. Gnosis Pay has said only that there was "unauthorised access" to the consumer card system. It says it replaced "affected security credentials" and fixed "the vulnerability." That wording suggests credentials played some role, either stolen or exposed through the flaw. The company has not said whether the weakness was in its own code, a third-party card-processing component or an access-control setup. It has not named a threat actor, and no group has claimed the attack. Nothing in the reporting so far connects this breach technically to the June delay-module exploit, which targeted on-chain account logic rather than customer data.
The company says it is carrying out a full review and arranging specialist monitoring for misuse of the exposed data. No technical post-mortem has been published.
What Organizations Should Do
- Minimise data on systems being retired. Once a platform has a shutdown date, purge or tokenise customer data it no longer needs, such as stored card data, KYC files and wallet links, rather than leaving it in place until the switch-off. Treat legacy systems as fully in scope for monitoring and patching until the data is gone.
- Separate identity data from wallet data. Crypto card issuers and exchanges should store KYC records separately from wallet addresses, with different access controls and credentials, so that one compromised credential cannot produce a joined identity-plus-wallet record.
- Never keep CVVs after authorisation. PCI DSS prohibits storing card verification codes. If any reports of CVV exposure are confirmed, review where card data is held in plain text, and move to the processor's tokenisation so card numbers never sit on your own systems.
- Rotate and limit service credentials. Gnosis Pay's fix involved replacing credentials. Audit long-lived API keys and service accounts on payment systems, limit them to the minimum access needed, and alert on unusual bulk reads of customer tables.
- Publish a full data-field inventory at disclosure. Gnosis Pay's statement listed no data fields while customers posted detailed notices, which left the press to piece together four different lists. Publish the categories of data exposed and the number of people affected, and coordinate with regulators on timing.
- Warn affected crypto customers about physical security. When home addresses are linked to wallets, notices should cover more than phishing. Advise customers to move funds to new wallets that are not linked to their identity and to be careful about unexpected deliveries or visitors.
Sources: PYMNTS Gnosis Pay Breach Reveals Crypto Customer Home Addresses | Crypto debit card provider Gnosis Pay breach exposes card numbers,... | Gnosis Pay Confirms Breach of Card Customer Data The Defiant | Gnosis Pay Data Breach Exposes Sensitive Customer Records | Gnosis Pay discloses data breach before December closure | Gnosis Pay Data Breach Exposes Card Numbers and ... | Gnosis Pay Data Breach Exposes Card, Wallet Details | Gnosis Pay data breach: what was exposed and what to do – Coindaro