Gnosis Pay Says November 3 Breach Exposed Card Numbers and Wallet Addresses

Breach Detected November 3

Gnosis Pay, the crypto-linked Visa debit card issuer inside the Gnosis ecosystem, confirmed on Friday that customer card data and personal records leaked from its legacy consumer card system. In its breach announcement, the company said it spotted unauthorized access within the legacy platform behind its Gnosis Pay-branded consumer cards on November 3 and had containment underway within two hours. Customer funds were not affected, and the separate enterprise platform that serves white-label card programs was untouched, per the company's disclosure. Gnosis Pay operates as a fintech service offering payment cards tied to crypto assets, so the event sits in payments infrastructure rather than on a blockchain itself. The exposed records reach well beyond card numbers. Notifications sent to affected users list complete card numbers, expiry dates and CVV codes alongside customer names, home addresses and the crypto wallet addresses linked to their accounts. Email addresses, phone numbers and nationalities were also swept up, and some records included banking details such as IBAN and BIC codes. What the company has not said is how many customers were affected, or how the intruders got in; both questions remain open in the disclosure as written.

Cards Canceled, 3D Secure Mandated

The blast radius differs from user to user. Some customers were told that only their name as printed on the card, their shipping address and their Gnosis Pay account reference were exposed. Rotki founder Lefteris Karapetsas shared a breach notification stating that his exposed information included his full home address, his name, his card number and every wallet address tied to his account. The same notification confirmed his card was canceled on November 3, with no suspicious activity or fund movement on record, which points to a data leak rather than direct theft at this stage. Gnosis Pay says it replaced compromised security credentials and fixed the vulnerability. As an interim control, 3D Secure verification, the extra authentication layer used for online card payments, is now mandatory for all online purchases until the legacy platform's scheduled retirement on December 20. The company has also warned customers to expect phishing attempts that reuse their personal or transaction details, and says it is arranging monitoring for possible misuse of the stolen data. Because complete card credentials sit among the exposed fields, the company treats the fraud risk as ongoing even though no misuse has been recorded so far.

2,400 Daily Active Cardholders

Third-party platform OpenRate, which tracks crypto card activity, puts Gnosis Pay at roughly 2,400 daily active cardholders, with $263,200 in transactions processed over the 24 hours before the disclosure went public. That figure describes baseline usage around the incident rather than a measured drop in activity, and no post-breach usage data has been published. It still gives a sense of the user base the leak could touch, though the company has not confirmed whether all, some or only a handful of those cardholders were affected. Gnosis Pay also issues white-label stablecoin cards for enterprise partners, and that business line runs on separate infrastructure the company says was not involved. The legacy consumer system was already scheduled for shutdown at the end of the year, a decision that predates the breach; the December 20 retirement date now doubles as the endpoint for the interim 3D Secure requirement. The disclosure itself says nothing about the GNO token, so readers following GNO technical analysis should keep the market thread separate from the security thread. The company did not immediately respond to requests for comment, so the affected customer count and the root cause both remain unconfirmed.

Phishing Risk, Not Fund Loss

Our reading: the line that matters is between data that identifies and data that unlocks. Wallet addresses identify; they cannot move funds, unlike a private key, which does not appear in the list of exposed fields the company published. The realistic danger is targeted phishing, since someone holding a home address, card number and transaction context is well positioned to impersonate the issuer or a bank. Cardholders who keep spending balances separate from long-term reserves, holding savings on a hardware wallet rather than a hot wallet, carry a smaller exposure. Nothing in the disclosure explains how access was gained, so the cause is not yet settled. For protocol-side context, Gnosis recently reduced bridge confirmations to about 12 seconds with FCR, a chain-level change this card-system breach does not involve, and our Crypto Exchange vs Crypto Wallet guide covers the custody basics behind that distinction.