USD
Gnosis Pay Data Breach Exposes Customer Information; Funds Unaffected, Company Says
Hackers accessed a legacy debit card system, prompting stricter payment security ahead of its scheduled shutdown
TL;DR
- Gnosis Pay disclosed a data breach on November 6, 2026, after detecting unauthorized access to its legacy consumer debit card system on November 3.
- Rotki founder Lefteris Karapetsas reported that his name, home address, card number and linked crypto wallets were exposed. Gnosis Pay said customer funds were unaffected.
- The company has made 3D Secure verification mandatory for online card payments until the affected system is retired on December 20.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Gnosis Pay disclosed a data breach on Friday, November 6, 2026, after attackers gained unauthorized access to a legacy system supporting its consumer debit cards, exposing customer information. The company said its monitoring systems detected the intrusion on November 3 and that it contained the incident within two hours. Gnosis Pay maintained that customer funds were not affected and that its enterprise platform, which powers white-label card programs for other businesses, remained untouched.
Following the discovery, Gnosis Pay replaced compromised security credentials and addressed the vulnerability that enabled the intrusion. The company also introduced mandatory 3D Secure verification for online card payments as an additional safeguard while preparing to retire the affected system.
Affected customers received emails identifying the specific information compromised in their accounts. Gnosis Pay also notified its partners, contacted the relevant card issuers and informed data protection authorities. The regional issuers involved were identified as Monavate Ltd and UAB Monavate.
What Customer Information Was Exposed in the Gnosis Pay Breach?
The breach exposed personal information stored in Gnosis Pay's legacy consumer card infrastructure, although the full scope of the compromised records remains unresolved.
Lefteris Karapetsas, founder of Rotki, said on X that his name, home address, card number and every cryptocurrency wallet address linked to his account had been exposed. His account provides a specific example of the information accessed but does not establish whether other affected customers experienced the same level of exposure.
Gnosis Pay has not established a public count of affected customers or clarified whether the categories of exposed information differed between accounts. The company has also not officially confirmed whether email addresses, phone numbers, card security codes or banking details were compromised. Its assertions that customer funds and enterprise systems remained secure have not been independently verified.
The incident highlights a distinction between protecting cryptocurrency holdings and securing the personal information associated with payment cards. Customers can control assets in their own wallets while payment providers retain identity and card records. Linking a person's name and residential address to identifiable crypto wallets could facilitate targeted phishing attempts or physical threats.
Blockchain analytics firm Chainalysis estimated that violent attacks targeting cryptocurrency holders caused more than $30 million in losses by mid-2026. However, there is no evidence linking those incidents to the Gnosis Pay breach.
Breach Follows Separate $1.5 Million Exploit in June
The latest data breach is separate from the Zodiac smart-contract exploit that affected Gnosis Pay in June.
That earlier incident involved a software vulnerability that attackers exploited to steal approximately $1.5 million, while another $300,000 became inaccessible. Gnosis subsequently covered the losses and restored customer funds.
The incidents involved different parts of the company's infrastructure. The earlier exploit targeted software securing card wallets, while the latest breach affected personal information held in an older consumer card system.
Other cryptocurrency card providers have experienced security incidents involving customer data or payment infrastructure. Based disclosed that an attacker accessed an internal dashboard used to manage its Visa card program on October 5, exposing some customer information without successfully reaching deposited funds.
An August vulnerability in Rain's Solana card infrastructure also enabled unauthorized withdrawals from card balances belonging to Tria and Avici users. Separately, Revolut said an unauthorized third party used a fraudulent request sent from a legitimate government email domain to obtain sensitive customer information, potentially including account statements, identity documents and Bitcoin transaction histories. Revolut said customer funds and systems were unaffected.
Gnosis Pay Prepares Card Shutdown as Consumer Spending Declines
Gnosis Pay's affected legacy system was already scheduled for retirement before the breach occurred. The company announced in September that its consumer debit cards would stop working at 23:59 UTC on December 20.
Its web application will remain available for withdrawals as the business shifts its focus toward providing card services to other companies. The mandatory 3D Secure requirement will remain in place until the legacy system is retired.
The shutdown follows a significant contraction in Gnosis Pay's consumer card activity even as broader cryptocurrency card usage has increased.
Visa separately reported more than 160 stablecoin-linked card programs, with their payment volume rising nearly 200% year over year.
Gnosis Pay's consumer spending had already declined before the latest security incident. Consequently, the available figures cannot establish whether the breach affected customer activity. Its longer-term impact on the company's reputation and remaining business operations remains uncertain.
This article has been refined and enhanced by ChatGPT.
