Gnosis Pay Cyber Breach Exposes Linked Wallets, Card Data, and Customer Addresses

Gnosis Pay, a prominent cryptocurrency-linked Visa debit card provider, disclosed a significant data breach affecting its legacy consumer card system, exposing sensitive personal and financial information. The unauthorized access, detected on November 3, 2026, compromised full payment card numbers, home addresses, and linked cryptocurrency wallet addresses.[3][5]

While the company confirmed that no customer funds or smart contracts were affected, the breach highlights the persistent vulnerability of traditional Web2 infrastructure bridging fiat and digital assets. The incident has prompted immediate security upgrades, including mandatory 3D Secure verification for all online transactions, as the company prepares to decommission the affected system in December.[1][3][4]

The Breach Mechanism

The intrusion targeted Gnosis Pay's business-to-consumer infrastructure, a legacy system designed to process retail debit card transactions. Security monitoring systems flagged the unauthorized access on November 3, prompting an immediate emergency response from the company's technical team to secure the perimeter.[2][4][5]

According to incident reports, containment efforts began within two hours of the initial detection. Engineers revoked the compromised security credentials, isolated the affected servers, and addressed the underlying vulnerability that allowed attackers to bypass the system's external defenses.[1][3][5]

The breach was strictly confined to the infrastructure supporting Gnosis Pay-branded consumer cards. The company's separate enterprise platform, which provides white-label card infrastructure to other wallets, fintech companies, and business partners, remained entirely unaffected by the intrusion.[1][3]

Crucially, the attackers did not breach the cryptographic security of the Gnosis blockchain or any associated smart contracts. The incident functioned as a traditional database exfiltration rather than a decentralized finance exploit, meaning that user funds held in on-chain wallets were never at risk of direct theft.[1][2][5]

Scope of the Compromised Data

Despite the swift containment, the attackers successfully copied a substantial volume of highly sensitive personal and financial data. Gnosis Pay has not publicly disclosed the total number of affected users, but the platform reportedly maintained around 2,400 daily active cardholders processing over $263,200 in daily volume prior to the incident.[3]

The exfiltrated records included full payment card numbers, expiration dates, and CVV security codes. This financial data was stored alongside comprehensive personal identifiers, including cardholder names, physical home addresses, email addresses, and phone numbers.[4][5]

In some cases, the compromised databases also contained detailed banking information, such as International Bank Account Numbers and Bank Identifier Codes, as well as users' declared nationalities. The inclusion of linked cryptocurrency wallet addresses makes the leak particularly severe for privacy-conscious digital asset holders.[1]

Rotki founder Lefteris Karapetsas, one of the affected customers, publicly confirmed the extent of the exposure. Karapetsas reported that his breach notification detailed the compromise of his full name, home address, card number, and all cryptocurrency wallet addresses associated with his Gnosis Pay account.[5]

In response to the data theft, Gnosis Pay immediately canceled the affected physical and virtual debit cards on November 3. The company stated that no suspicious transactions or unauthorized movement of funds had been detected on the compromised cards prior to their deactivation.[1]

Security Measures and System Retirement

Following the containment of the breach, Gnosis Pay introduced mandatory 3D Secure verification for all online payments processed through its network. This additional authentication layer requires users to actively approve digital transactions, mitigating the risk of attackers monetizing the stolen card details.[2][3][4]

The company also implemented enhanced monitoring protocols across its network, specifically targeting card transactions and connected cryptocurrency wallets for any signs of anomalous activity. These heightened security measures will remain in place until the legacy consumer system is permanently taken offline.[1][2]

Gnosis Pay clarified that the compromised business-to-consumer infrastructure was already scheduled for retirement prior to the cyberattack. The company plans to fully decommission the legacy consumer card system on December 20, 2026, transitioning its focus entirely to its secure enterprise and white-label platforms.[3][4][5]

The firm has formally notified its business partners, its regulated UK card issuer Monavate Limited, and the relevant data protection authorities regarding the unauthorized access. Gnosis Pay is currently coordinating with these entities to ensure compliance with privacy regulations and to facilitate ongoing specialist monitoring.[1][3]

The Divide Between Web3 and Web2 Security

The Gnosis Pay incident underscores a structural vulnerability in the cryptocurrency ecosystem: the reliance on traditional Web2 databases to facilitate real-world fiat payments. While blockchain protocols undergo rigorous auditing and rely on cryptographic proofs, the centralized servers storing customer compliance data remain susceptible to conventional cyberattacks.[1][5]

Bad actors increasingly target these fiat gateways because breaking into audited smart contracts requires immense technical sophistication, whereas exploiting a database vulnerability often yields a lucrative trove of personal information. The dynamic resembles a highly secure bank vault paired with an easily accessible filing cabinet in the lobby.[1]

This structural weakness has plagued the digital asset industry throughout 2026, with similar third-party data leaks affecting prominent hardware wallet manufacturers. Companies including Ledger, Trezor, SafePal, and Keystone have all suffered breaches where customer shipping addresses and contact details were exposed, despite their core cryptographic hardware remaining secure.[1][5]

AI

The exposure of physical addresses tied to known cryptocurrency holdings presents a unique physical security risk. In recent years, criminals have utilized leaked customer databases to orchestrate targeted home invasions, commonly referred to as wrench attacks, aimed at forcing victims to surrender their digital assets.[1][5]

Industry Context and Phishing Risks

Beyond physical threats, the compromised data provides attackers with the necessary components to launch highly sophisticated social engineering campaigns. Armed with a user's full name, home address, and specific transaction history, scammers can craft convincing impersonation attempts that bypass standard skepticism.[3]

Gnosis Pay has explicitly warned its customer base to treat any unexpected communications regarding their accounts with extreme caution. The company emphasized that attackers might reference genuine past purchases or accurate banking details to establish credibility during phishing calls or emails.[2][3]

The payment provider reiterated its core security policy, reminding users that official representatives will never request seed phrases, private keys, PIN codes, or full card numbers through email, text messages, or telephone conversations. All legitimate account modifications are processed exclusively through the official Gnosis Pay application.[3][4]

The November breach follows a previous security incident in June 2026, where attackers exploited vulnerabilities in Gnosis Pay's Delay Module and Roles Module. That earlier exploit compromised certain user Safe wallets, resulting in approximately $1.5 million in losses and highlighting the persistent operational risks facing crypto-fiat payment bridges.[2]

Long-Term Privacy Implications

The immediate fallout from the Gnosis Pay breach appears contained, with the swift cancellation of affected cards preventing direct financial theft. However, the long-term consequences for the affected users remain uncertain, as their immutable blockchain addresses are now permanently linked to their real-world identities and physical locations.[1][5]

As the December 20 shutdown of the legacy system approaches, the incident serves as a stark reminder of the privacy trade-offs inherent in cryptocurrency debit cards. The broader digital asset industry continues to grapple with the challenge of bridging decentralized finance to the traditional banking system without compromising the anonymity and security of its users.[1][3][5]