Gnosis Pay Confirms Legacy Card System Breach, Funds Reported Safe

By Coinvote

Published November 7, 2026 - 11:21 UTC | 5 mins read

Gnosis Pay Confirms Legacy Card System Breach, Funds Reported Safe

Gnosis Pay says attackers reached its legacy consumer card system on Nov. 3, exposing personal details and, for some users, card and wallet information, while funds were untouched. The company has not said how many customers were hit, and outlets differ on what was exposed.

Attackers got into the older consumer card system on Nov. 3

Gnosis Pay, a provider of crypto-linked Visa debit cards, disclosed on Friday that an unauthorized party had reached the system behind its own branded cards. Cointelegraph reported that the company detected the intrusion on Nov. 3 and began containing it within two hours.

The Block described the incident in similar terms in its headline and summary, saying the breach hit the legacy debit card system and that customer funds were not affected. Decrypt, citing a company blog post, said Gnosis Pay has swapped out the credentials that were compromised and closed the security flaw.

What information may have been exposed

The most detailed list comes from Cointelegraph, which reviewed breach notifications sent to customers. It said the exposed items varied by account, and that some people also had banking details exposed.

One customer notification described in that report stated that the card was cancelled on Nov. 3 and that nothing unusual had been seen in transactions or fund transfers.

Full payment card numbers, expiration dates and CVV codes.
Customer names, home addresses, email addresses, phone numbers and nationalities.
Wallet addresses linked to affected accounts.
In some cases, IBAN and BIC banking details.

The numbers that frame the incident

The company has not published a count of affected customers, according to both Cointelegraph and Decrypt. The only scale indicator comes from OpenRate, a third-party platform that tracks crypto card activity, as cited by Cointelegraph.

Nov. 3: date Gnosis Pay says it detected the unauthorized access.
Two hours: time the company says it took to begin containment.
Dec. 20: planned retirement date for the legacy consumer system.
Around 2,400: daily active cardholders, per OpenRate.
$263,200: card transactions processed over the previous 24 hours, per OpenRate.

How the outlets' accounts compare

The reports agree on the core facts: the Nov. 3 detection, the legacy consumer business line, and the absence of any reported effect on funds. They diverge on how much detail the company has shared. Cointelegraph itemized card numbers, CVV codes and banking details from notifications it reviewed, while Decrypt wrote that Gnosis Pay did not say what information was exposed, only that each affected customer received an email.

Protos adds a middle view by quoting the notification text. It reported that some users were told only about the name printed on their card, a shipping address and an account reference. Others, such as Rotki founder Lefteris Karapetsas, were told that a full home address, card number and all linked wallet addresses were involved. That pattern fits Cointelegraph's point that exposure differed from person to person.

The outlets also differ on timing and framing of the shutdown. Cointelegraph and Decrypt give Dec. 20 as the retirement date, whereas Protos says only that the system was due to be sunset at the end of the year. Protos describes Gnosis Pay as a white-label stablecoin card issuer, while Decrypt and Cointelegraph separate the affected consumer line from an enterprise platform that serves white-label programs and was not touched.

Why the legacy system and 3D Secure matter

According to both Cointelegraph and Decrypt, Gnosis Pay now requires 3D Secure for every online card payment, a rule that lasts until the legacy platform is shut down. 3D Secure adds a verification step, so a thief holding a card number and CVV code cannot complete an online purchase with those details alone. That is a meaningful safeguard when card numbers and CVV codes are among the reported exposures.

Decrypt also reported that the company increased its fraud surveillance of cards and wallets, informed its card issuer, its partners and data regulators, and is setting up specialist monitoring for any misuse of the data. Wallet addresses are public identifiers, but when they are tied to a name and a home address they can reveal a person's holdings, which is why the company's warnings go beyond ordinary card fraud.

Why it matters beyond one card provider

Decrypt placed the breach among a run of recent incidents. It pointed to a record-setting $6.4 billion hack of Binance and to a Coinbase statement from the previous week saying that some customer contact data was exposed through a breach at the analytics provider Amplitude. It also cited Ledger, which said that every confirmed case in a suspected $87 million theft was tied to hardware purchased through the reseller CryptoBilis.

The company urged customers to treat unexpected messages with suspicion even when they contain accurate personal details. Decrypt said Gnosis Pay will not ask for seed phrases, PINs or complete card numbers, and will not ask anyone to move funds. It also advised care when sharing addresses or crypto holdings. Decrypt tied that advice to physical wrench attacks, and cited Chainalysis as saying that more than $30 million was stolen this way in the first six months of 2026, a pace that points to a record year.

Open questions for cardholders and project teams

The main unanswered point is scale. Neither Gnosis Pay nor the outlets have said how many people received a notification, and Gnosis Pay had not responded to requests for comment from Cointelegraph or Protos at the time of their reports. Whether the company will publish a fuller account of how the intruder gained access is also unknown.

Practical checks follow from the reporting. Holders should read their notification carefully to see which items were listed, treat any message that quotes their address or purchases as possibly fraudulent, and confirm that online payments now require 3D Secure. Teams that run white-label card programs can note that the company says its enterprise platform was unaffected, and they may want to ask providers how any retiring systems are secured until shutdown.

FAQ

Were funds stolen in the Gnosis Pay breach?

Gnosis Pay says customer funds were not affected, a point repeated by The Block, Decrypt and Cointelegraph. Cointelegraph also described a customer notification stating that no suspicious transactions or movement of funds were detected.

What information was exposed in the Gnosis Pay breach?

Cointelegraph reported that notifications listed card numbers, expiration dates, CVV codes, names, home addresses and linked wallet addresses, plus banking details in some cases. Protos found that some users were told only about their printed name, shipping address and account reference.

What should Gnosis Pay cardholders do now?

The company warned customers to be cautious about phishing that uses real personal or transaction details. It said it would not ask for seed phrases, PINs or complete card numbers, and that all online card payments require 3D Secure verification through the planned closure of the legacy platform on Dec. 20.