Gnosis Pay discloses data breach on its branded crypto debit cards

Gnosis Pay published a notice on its blog on 6 November 2026 describing a data breach affecting the legacy system that powers the cards issued under its own name, its consumer-facing (B2C) business. According to the notice, the company's monitoring systems detected unauthorised access to that system on 3 November 2026, and some customer information was exposed. Gnosis Pay is the trading name of Gnosis Pay Co Ltd, a company registered in the United Kingdom under number 14919639.

Containment began within two hours, the company says

According to the Gnosis Pay notice, the security team began containing the intrusion within two hours of detection. It then rotated the affected security credentials and fixed the vulnerability. The company says it is carrying out a full review and has set up dedicated monitoring to spot any misuse of the stolen data.

The notice draws a clear boundary around the incident: only the Gnosis Pay-branded card system is involved. The business platform, which runs every white-label card programme offered through partner apps, was not affected, according to the company. Gnosis Pay also states that customer funds have not been touched.

Also according to the notice, every affected customer received an email on 6 November detailing what information was taken from their account. The company says it has informed its partners and is in contact with the relevant data protection authorities and with the card issuer. The debit card is issued by Monavate Limited under a Visa Europe licence; Monavate is authorised by the UK Financial Conduct Authority (FCA) as an electronic money institution (FRN 901097). On its X account, Gnosis Pay also said it "deeply regrets" the incident and takes full responsibility for it, according to Coin Edition, Incrypted and crypto.news. In the same post, the company invited security researchers to report vulnerabilities to bounty@gnosis.io, with the same rewards as for Gnosis Chain, CoinLaw and Incrypted reported.

Exposed data differs from one account to another

The public notice refers only to "certain customer information". The individual notifications sent to cardholders, reported by Cointelegraph, CoinDesk and CoinLaw, mention payment card numbers, home addresses and the addresses of crypto wallets linked to the accounts, among other data.

What was exposed varies by account. Lefteris Karapetsas, founder of Rotki, said on X that his name, address, card number and all of his linked wallet addresses were among the exposed data. The notice received by a Protos journalist listed a narrower set: the name on the card, the delivery address and an account reference, according to CoinLaw, ForkLog and Cointelegraph.

Several questions remain open. The number of affected customers has not been disclosed, according to Cointelegraph, Cryptoticker and CoinGape. How the attackers got in and who is behind the attack have not been specified either, Cryptoticker and BlockchainReporter report. Nothing has been communicated about whether the data is already circulating or being offered for sale.

The incident comes a few months after another one. In June 2026, a separate flaw affecting Gnosis Pay card accounts cost around 1.5 million dollars in digital assets; the company attributed it to a defect in the Zodiac smart contract framework and said it had fully reimbursed affected customers, according to crypto.news, CoinGape and BlockchainReporter. The November announcements do not connect the two incidents.

3D Secure mandatory until the 20 December shutdown

The affected B2C system was already scheduled to close on 20 December 2026, and that date still stands, the notice says. Until then, Gnosis Pay has stepped up monitoring of card transactions and wallets and made 3D Secure mandatory for all online card payments.

The company urges customers to treat with suspicion any unexpected email, text message, call or letter about Gnosis Pay, a partner app or the card, even if it contains genuine personal data or refers to a real purchase. It advises against clicking links and recommends going directly through the official web app or the partner app. Gnosis Pay points out that neither it nor its partners ever ask for a recovery phrase (seed phrase), private keys, the PIN or the full card number, nor do they ask customers to "re-verify" their identity or move funds by email, text message or phone; any account change is made only inside the official app.

The notice also calls for care over who receives one's address or details of one's crypto holdings, online and offline. It states that further steps were recommended to each customer depending on which data was accessed. The contact address given for questions is help@gnosispay.com.

What it means for traders

Traders who use a Gnosis Pay-branded card to spend their crypto assets would be the ones directly affected; according to the company, cardholders who obtained their card through a white-label partner app are not. The email dated 6 November 2026 would be the most direct way to establish which data was taken from a given account. Where there is doubt, writing to help@gnosispay.com by typing the address manually would avoid relying on a link received by message.

The main risk would lie in targeted phishing. Fraudsters holding a name, a postal address, a card number and wallet addresses could produce highly convincing emails or paper letters, or pose as technical support. With 3D Secure now required, a verification request arriving with no purchase under way would be a warning sign, warranting a refusal and a check of recent transactions in the official app. Customers whose card number appears in their notification would have an interest in following the instructions received, including blocking or replacing the card through the app.

For crypto holders, the link that can now be drawn between an identity, a home address and wallets whose activity remains visible on the blockchain would also raise a physical security issue, one the Gnosis Pay notice addresses directly by calling for discretion about holdings.

Finally, the 20 December 2026 shutdown would require cardholders to arrange another means of payment, particularly for subscriptions and recurring payments attached to the card. As for possible recourse, Gnosis Pay says it is in contact with data protection authorities, and the card issuer, Monavate Limited, falls under FCA supervision.