Gnosis Pay tells card users a breach exposes home addresses, card numbers, linked wallet addresses

Gnosis Pay says attackers gained access to the system behind its consumer crypto debit cards, exposing customer data that in at least one case included a home address, card number and every linked wallet address. The company says its enterprise platform was not affected, and the compromised system was already due to shut down on December 20, 2026.

The disclosure raises concerns beyond payment fraud. Personal details linked to wallet addresses could help criminals identify cryptocurrency users and craft convincing messages using information those customers would expect only a legitimate service provider to possess.

Gnosis Pay breach detected days before public disclosure

Gnosis Pay said its monitoring systems identified the intrusion on November 3, three days before the public announcement.

“On 3 November 2026, our monitoring systems detected unauthorized access to the system powering Gnosis Pay-branded cards (our B2C business line), resulting in the exposure of certain customer information,” the company said.

The company described a response that began shortly after detection and included changes to the credentials protecting the affected infrastructure.

“Our security team responded immediately and containment began within two hours of detection. We subsequently replaced the affected security credentials and addressed the vulnerability.”

Those statements establish when the company detected the Gnosis Pay breach and began containment. The supplied report does not specify when the attackers first gained access, how many customers were affected or how long the unauthorised access lasted.

Gnosis Pay said the incident was confined to its branded consumer card system. Its enterprise infrastructure, which supports all of its white-label card programmes, was not impacted, according to the company.

Customer notification identifies exposed home and wallet addresses

More detail about the Gnosis Pay breach emerged through an email shared by Eleftherios Karapetsas, founder of cryptocurrency portfolio tracker Rotki.

Karapetsas posted the notification on X. According to the report, it said the stolen information included his name, full home address, card number and every wallet address connected to his account.

“You had already lost me as a user but you could have at least protected my data,” Karapetsas wrote.

His notification provides a specific example of the information exposed. The supplied report does not establish whether every affected customer had the same categories of data compromised.

The combination of personal and blockchain information is central to concerns about the Gnosis Pay breach.

A wallet address can be used to examine publicly visible blockchain activity; linking it to a name and residential address can make that activity attributable to an identifiable person.

CoinDesk, which reported on the incident on November 7, noted the resulting risk of targeted scams. Criminals could use the stolen information to connect customers’ real-world identities with their cryptocurrency holdings.

Gnosis Pay also warned that personal details and purchase histories could make fraudulent messages appear legitimate. Familiar transaction information may give a scammer’s approach an appearance of credibility, even when the message itself is fraudulent.

Mandatory payment checks follow Gnosis Pay breach

The company said it had made 3D Secure verification mandatory for online card payments and increased fraud monitoring ahead of the consumer platform’s planned closure.

Those measures address payment risks during the remaining weeks of the legacy system’s operation. The December 20 retirement date was already in place before the incident, according to Gnosis Pay.

The response to the Gnosis Pay breach therefore includes both immediate security changes and closer monitoring until the affected service shuts down.

However, protecting subsequent payments and addressing exposed personal information are separate challenges. Replacing compromised security credentials addresses access to the affected system, while the company’s scam warning concerns information that attackers may already possess.

The supplied report does not identify a loss of customer cryptocurrency resulting from this incident. Its central disclosure concerns exposed data and the potential for that information to be misused.

Disclosure adds to digital asset security concerns

The Gnosis Pay breach comes amid other reported security incidents involving digital asset businesses. PYMNTS cited a late-October attack on Binance involving more than $6 billion and a separate $40 million hack that Brazil’s Mercado Bitcoin said it would absorb.

The report also noted that Nubank and Mercado Pago paused some cryptocurrency operations following problems involving third-party providers.

Those incidents differ in their causes and consequences. The supplied account does not attribute the Gnosis Pay intrusion to an outside vendor.

Separately, PYMNTS Intelligence research highlights how compromised business relationships can contribute to fraud. It found that compromised vendors or suppliers were involved in 38% of fake invoice scams and 43% of phishing incidents.

For customers affected by the Gnosis Pay breach, the immediate concern is the combination of identifying information, payment details and connected wallets. The company has announced tighter verification and monitoring, but the disclosure leaves unanswered questions about the number of affected users and the full extent of the stolen data.