Gnosis Pay Data Breach Exposed Home Addresses, Card Numbers and Wallets From Nov. 3

Nov. 3 Intrusion in the Legacy Card System

A data breach at crypto debit card issuer Gnosis Pay has exposed customers' home addresses, card numbers and every cryptocurrency wallet linked to their accounts. The company said it detected unauthorized access to its legacy consumer card system on Tuesday, Nov. 3, and began containing it within two hours, replacing affected security credentials and closing the flaw that let the intruders in. How the access was gained has not been publicly described. The HOME price slipped 3.3% over the past 24 hours per COINOTAG's live spot monitoring, a market move we read as separate from the disclosure.

The exposed file is unusually complete. Lefteris Karapetsas, founder of the portfolio tracker Rotki, published the notification email he received from the firm in a post on X, reporting that it listed his name, his full home address, his card number and every wallet address tied to his account. “You had already lost me as a user but you could have at least protected my data,” he wrote. That combination is the core problem: it lets an attacker connect a real-world identity to on-chain holdings, which is the prerequisite for a targeted scam rather than a nuisance leak. Rotki is a self-custody portfolio tool, and its founder's case shows the exposure applied even to someone who had already stepped away from the service. Customer funds were not affected, the company said, and its separate enterprise platform, which powers card programs for other businesses, was untouched as well. Card numbers sat in the same exposed set, so the leak reaches past crypto into everyday payment records. What the firm has not disclosed is how many people were hit; it said only that it emailed each affected user with the specifics of their case.

Gnosis Pay, unveiled in 2023, allows users to spend stablecoins with Visa debit cards tied to their crypto wallets, and public payments tracking puts its annualized volume near $67.6 million. The Nov. 3 intrusion is its second security incident of 2026. In June, an exploit of a wallet software flaw drained roughly $1.5 million; the company absorbed those losses, made customers whole and published a post-mortem attributing the drain to that flaw. The two events differ in kind: June took funds, this month took data, and exposed data cannot be clawed back the way stolen funds were.

Since the June incident the firm has made 3D Secure checks a requirement for online card payments and expanded its fraud monitoring. It has also warned that scammers could use the stolen personal details and past purchase information to make fraudulent messages look legitimate. This is not abstract FUD: a message that quotes a real card number or a recent purchase is far harder to dismiss than generic phishing, and a home address on file makes it more convincing still. The timing adds a further wrinkle. Gnosis Pay plans to switch off its branded consumer cards on Dec. 20 to concentrate on partner programs, so the system that leaked is already scheduled for retirement, while the enterprise platform serving other businesses' card programs continues untouched.

The Identity Map Outlives the Shutdown

What Gnosis Pay lost this month was not money but a map: names, street addresses, card numbers and linked wallet addresses joined in one record. No key was exposed, so moving funds to a cold wallet buys little, and a crypto mixer cannot unbind an address already tied to a name. Hardware options, up to a Tangem mobile wallet, protect keys, not customer files. The residual danger is the kind that has already turned physical in France, where masked men tied up a couple in a Landes crypto home invasion after their holdings became known. The Dec. 20 shutdown retires the card system; the records it leaked do not retire with it.