Gnosis Pay, a provider of crypto-linked Visa debit cards, has disclosed a leak of customer data from its old consumer system. Unauthorized access was detected on Nov. 3, and the company acknowledged the incident publicly on Friday, Nov. 6. User funds were not affected.
What happened
Monitoring systems spotted the intrusion on Nov. 3, and the company began containing it within two hours. Gnosis Pay said so in its blog and on its X account.
Only the B2C line was breached, meaning cards issued under the service's own brand. The enterprise platform that runs white-label programs for fintech firms, wallets and neobanks was not touched. The consumer platform was already due to shut down on Dec. 20.
The company did not say how many people were hit. According to OpenRate, a service that tracks the crypto card market, Gnosis Pay has about 2,400 daily active cardholders and handled $263,200 in transactions over 24 hours. As Decrypt reports, each affected customer received a separate email listing the stolen data.
What data reached the hackers
Judging by customer notifications seen by Cointelegraph, the haul was very wide. It covers:
- full card numbers, expiration dates and CVV codes
- customer names and home addresses
- addresses of crypto wallets linked to accounts
- email addresses, phone numbers and nationality
- IBAN and BIC bank details, though not in every case
One customer told CoinDesk that the leak tied his home address and card number to every wallet connected to his account. For anyone with a large balance, that is a ready-made base for targeted scams. A notice published by another user says his card was canceled on Nov. 3, and the company found no suspicious transactions.
Gnosis Pay response
The company replaced the compromised access keys and closed the vulnerability. Until the consumer platform is retired, 3D Secure, an extra payment confirmation step, is now mandatory for all online payments.
Partners, the card issuer and data protection authorities have already been informed. The company is also arranging specialist monitoring that will watch for attempts to use the stolen information.
Customers are urged to treat unexpected messages about their card with caution, even if they quote real personal details or purchases. Gnosis Pay reminded users that it never asks for seed phrases, PIN codes or full card numbers, and never asks anyone to move funds. One more tip concerns your address and details of your crypto holdings, which should not be shared online or offline.
On X the company wrote: "While funds were not affected, the security of personal information is just as important and we take full responsibility".
One more incident in a row
The advice about addresses is no accident. According to Chainalysis, physical attacks on crypto holders, from home invasions to kidnappings, brought criminals more than $30 million in the first half of 2026, and the year is heading for a record. A home address next to a list of wallets gives exactly what such an attack needs.
For the industry this is not the first blow in a few weeks. The record hack of Binance topped $6 billion, Coinbase said last week that a breach at analytics vendor Amplitude exposed contact data of some customers, and Ledger confirmed that all cases in a suspected $87 million drain involved devices bought from reseller CryptoBilis. Owners of the Ledger hardware wallet were told to move funds to new devices.
Anyone who keeps Bitcoin or other assets on a card service should check this story against their own case: what exactly the company knows about you and where it is stored.
Comments
Your email address will not be published. Required fields are marked *