TLDR
- Gnosis Pay found unauthorized access to its legacy card system on Nov. 3.
- Exposed data includes card numbers, CVV codes, home addresses and wallet addresses.
- The company says customer funds and its enterprise platform were not affected.
- 3D Secure is now required for online payments until the system retires on Dec. 20.
- Other crypto card providers reported similar incidents in recent months.
Gnosis Pay, a provider of crypto-linked Visa debit cards, disclosed a security breach on Friday. The incident exposed customers’ payment card details, home addresses and crypto wallet addresses. The company said it found the problem in its legacy consumer card system.
We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information.
Everyone affected was sent an email today with full information.
We deeply regret that this happened. While funds…
— Gnosis Pay 💳 (@gnosispay) November 6, 2026
How the Breach Unfolded
Gnosis Pay said it detected unauthorized access on Nov. 3. It began containing the breach within two hours of finding it. The company said the issue was limited to the older system that powers its own branded debit cards.
Its separate enterprise platform was not touched. That platform runs white-label card programs for other companies. Gnosis Pay also said customer funds were not affected.
Breach notifications reviewed by Cointelegraph list the exposed information. It includes full payment card numbers, expiration dates and CVV codes. Customer names, home addresses and wallet addresses linked to the accounts were also exposed.
The compromised data also covered email addresses, phone numbers and nationalities. In some cases, banking details such as IBAN and BIC information were exposed. These are codes used to identify bank accounts and banks.
One customer shared a notification on social media. It confirmed the customer’s card was canceled on Nov. 3. The notice said no suspicious transactions or movement of funds were detected.
The company did not say how many customers were affected. It did not immediately respond to a request for comment from Cointelegraph.
What Gnosis Pay Is Doing About It
Gnosis Pay said it replaced the compromised security credentials. It also said it fixed the vulnerability that allowed the access. These steps were part of its response to the incident.
The company made 3D Secure verification mandatory for online card payments. This adds an extra identity check when a customer pays online. The rule stays in place until the legacy system is retired on Dec. 20.
Gnosis Pay also warned customers about phishing attempts. Scammers may use personal or transaction details to appear legitimate. The company said it was arranging monitoring for possible misuse of the stolen data.
Data from OpenRate, a third-party platform that tracks crypto card activity, gives a sense of the company’s size. Gnosis Pay had about 2,400 daily active cardholders. It processed $263,200 in transactions over the previous 24 hours.
The breach follows other incidents involving crypto card providers. Based said an attacker accessed an internal dashboard used to manage its Visa card program on Oct. 5. Some customer data was exposed, but the attacker reportedly did not reach deposited funds.
In August, a vulnerability in Rain’s Solana card infrastructure allowed unauthorized withdrawals. The affected balances belonged to users of Tria and Avici.
Revolut also reported a recent incident. It said an unauthorized third party used a fraudulent request from a legitimate government email domain. The party obtained sensitive customer information, which could include account statements, identity documents and Bitcoin transaction histories. Revolut said customer funds and systems were unaffected.
Gnosis Pay disclosed its breach on Nov. 6. The legacy system is still scheduled to retire on Dec. 20.
