Gnosis Pay Breach Exposes Cardholder Data While Funds Remain Unaffected

Gnosis Pay has disclosed unauthorized access to the legacy system behind its branded consumer debit cards, confirming that customer information was exposed during an incident detected on November 3. The company says user funds were not affected, but the breach raises potentially serious privacy and impersonation risks for cardholders whose personal and crypto-related information may have been compromised.

What Gnosis Pay disclosed

In a statement dated November 6, Gnosis Pay said monitoring systems detected the intrusion and its security team began containing the incident within two hours. It replaced affected credentials and addressed the vulnerability. The incident was limited to the Gnosis Pay-branded consumer card system; the enterprise platform powering white-label card programs was not affected, the company said.

The affected consumer platform was already scheduled to be retired on December 20, 2026. In the meantime, Gnosis Pay has made 3D Secure verification mandatory for online card payments and increased monitoring of wallet and card activity. It said these additional safeguards will remain in place until the planned retirement.

Latest Stories

3 min read • 52 seconds ago

FinCEN Drops Proposed Crypto Travel Rule Expansion and Lower Transfer Threshold

3 min read • 57 seconds ago

Aave Labs Acquires Avon Team to Bring Fixed-Rate Loans Into DeFi

3 min read • 1 minute ago

FinCEN Cuts MEXC Global Off From U.S. Banking Over Alleged $16 Billion in Illicit Crypto Flows

Read all latest stories →

The company said it emailed affected customers with details about the information taken from their accounts and reported the incident to relevant partners and authorities. Reporting by CoinDesk described exposed data that could include identifying information, card details and links to wallets. The company did not publish an overall affected-customer count in the statement reviewed for this report.

These distinctions are important. A statement that no money was taken does not mean a data breach has no consequences. Personal details paired with knowledge of a person’s crypto activity can enable highly tailored phishing, fraudulent support calls or other targeting.

Practical precautions for affected users

Gnosis Pay advises customers to be suspicious of unexpected emails, text messages, calls and letters, even when they contain authentic account or purchase details. Users should go directly to the official app or a trusted partner app rather than following a link in an unsolicited message.

No legitimate support representative should ask for a seed phrase, private keys, complete card number or PIN. Customers should also be wary of anyone claiming that funds need to be moved into a new wallet to protect them. The company’s statement says account changes are made within official applications rather than by email or phone.

The incident highlights the operational complexity of blending ordinary card networks with crypto wallets and identity systems. Even where the underlying digital assets remain under secure custody, adjacent databases can reveal relationships between customers and their financial activity.

For context, the expansion of stablecoin payment infrastructure — including bank and token payment routing networks — increases the importance of treating identity and payment metadata as sensitive information in their own right.

Sources: Gnosis Pay’s official November 6 incident notice; CoinDesk, November 7.