Gnosis Pay Data Breach Exposes Card Numbers, Home Addresses and Linked Crypto Wallets

Published November 8, 2026, 05:25 AM PKT. Based on Gnosis Pay's official disclosure of November 6, 2026 (primary source), with secondary reporting from CoinDesk and Cointelegraph on November 6 and 7, 2026.

Gnosis Pay disclosed on November 6, 2026 that hackers accessed customer data through the system behind its branded Visa debit cards, exposing payment card details, home addresses and linked cryptocurrency wallet addresses. The company said its monitoring systems detected the unauthorized access on November 3 and containment began within two hours. Customer funds were not affected, Gnosis Pay said, and the company has not said how many customers were hit.

What was taken: card numbers, CVVs and home addresses

Gnosis Pay's public statement says only that "certain customer information" was exposed, and that every affected customer was emailed on November 6 with exactly what was taken from their account. The breach notifications reviewed by Cointelegraph listed a far more specific set of fields: full payment card numbers, expiration dates and CVV codes, customer names, home addresses, email addresses, phone numbers and nationalities, and the wallet addresses linked to affected accounts. In some cases the notifications also listed banking details such as IBAN and BIC information.

One customer made the exposure concrete. Lefteris Karapetsas, founder of the open-source portfolio tracker Rotki, shared his breach email on X, saying the exposed data included his name, his full home address, his card number and every wallet address linked to his account. Another notification, shared with Protos, listed a narrower set: the name printed on the card, a shipping address and a Gnosis Pay account reference. The notices also confirmed that at least one customer's card was canceled on November 3, with no suspicious transactions or movement of funds detected.

Detected November 3, disclosed November 6

According to Gnosis Pay's disclosure, its security team responded immediately after monitoring flagged the unauthorized access on November 3, and containment began within two hours of detection. The company said it then replaced the affected security credentials and fixed the vulnerability that allowed the breach. It has not published a technical explanation of how the attackers got in, and it has not identified who was behind the intrusion.

The breach stayed inside one part of the business. Gnosis Pay said the intrusion hit only the legacy system powering its own branded cards, its consumer business line, and that its separate enterprise platform, which runs white-label card programs for wallets, fintech firms and neobanks, was not affected. The company said it has stepped up monitoring of card activity and wallets for fraud, and has made 3D Secure, an extra verification step, mandatory for all online card payments until the consumer system is retired. It reported the breach to its partners and its card issuer, and said it is communicating with the applicable data protection authorities and arranging specialist monitoring for signs the stolen data is misused.

A shutdown already scheduled for December 20

The breached system was already on its way out. Gnosis Pay announced on September 21 that its branded physical and virtual cards would stop authorizing transactions at 23:59 UTC on December 20, 2026, as the company winds down its consumer card business to focus on partner programs. The extra payment checks will stay in place until that retirement date. Gnosis Pay, unveiled in 2023, issues Visa debit cards that let customers spend stablecoins from self-custodied Safe wallets on Gnosis Chain. Third-party tracker OpenRate put the platform at roughly 2,400 daily active cardholders and about $263,200 in transactions over the previous 24 hours, according to Cointelegraph.

The doxxing risk: addresses tied to wallets

The breach is serious even though no funds were taken, because the stolen data connects real-world identities to crypto holdings. A wallet address on Gnosis Chain is public, and anyone holding it can read its balance and history on a block explorer, so pairing it with a name and a home address hands an attacker a ready-made target list. Gnosis Pay itself warned customers to be careful who they share their address or details of their crypto holdings with, online and offline.

That warning reflects a growing physical threat. Physical attacks on crypto holders, including home invasions and kidnappings, were on pace for a record year after more than $30 million was stolen in the first half of 2026, according to blockchain analytics firm Chainalysis, as reported by Decrypt. Gnosis Pay also urged customers to treat any unexpected message about their card with suspicion, even one that includes real personal details or a real purchase, and said it will never ask for a seed phrase, private key, PIN or full card number, never ask anyone to re-verify by email or text, and never ask anyone to move funds.

A second incident in five months

The breach follows a separate June exploit that drained about $1.5 million through a wallet software flaw, according to CoinDesk. It also lands in a week of security incidents across the industry. Beyond the record-setting $6.3 billion hack of Binance on October 29, Coinbase said last week that a breach at analytics vendor Amplitude exposed some customer contact data, Decrypt reported, and hardware wallet maker Ledger said last month that all confirmed cases in a suspected $87 million drain involved devices bought from CryptoBilis, a Southeast Asian reseller.

What to watch next

Three things will show how far the damage spreads. The first is whether Gnosis Pay discloses how many customers were affected, a number it has so far withheld. The second is whether the stolen card and identity data surfaces in fraud or phishing campaigns, which the company's specialist monitoring is meant to catch. The third is December 20, when the branded cards stop authorizing transactions and the consumer system closes for good. Until then, affected customers have been told to watch their card statements, treat unexpected messages as suspect, and contact help@gnosispay.com with concerns.

Sources

• Gnosis Pay, Data breach on the legacy system powering Gnosis Pay-branded cards, November 6, 2026 (primary source: the company detected unauthorized access on November 3, containment began within two hours, affected credentials were replaced and the vulnerability was addressed; funds were not affected; the breach was limited to the system behind Gnosis Pay-branded cards, already scheduled for retirement on December 20, 2026; the enterprise platform was not affected; 3D Secure is mandatory for online card payments until retirement; every affected customer was emailed with exactly what was taken; the breach was reported to partners, the card issuer and data protection authorities; customers were warned never to share seed phrases, private keys, PINs or full card numbers)
• CoinDesk, Crypto debit card provider Gnosis Pay breach exposes card numbers, home addresses and linked wallets, November 7, 2026 (secondary reporting: the breach exposed customers' personal and financial details, including home addresses, card numbers and linked cryptocurrency wallets; Lefteris Karapetsas, founder of Rotki, said the exposed data included his name, full home address, card number and every wallet address linked to his account; the June exploit drained about $1.5 million through a wallet software flaw)
• Cointelegraph, as carried by TradingView, Gnosis Pay breach exposes card details, personal data and crypto wallet information, November 6, 2026 (secondary reporting: breach notifications reviewed by Cointelegraph listed full payment card numbers, expiration dates, CVV codes, customer names, home addresses and wallet addresses, plus email addresses, phone numbers, nationalities and, in some cases, IBAN and BIC details; one customer's card was canceled on November 3; OpenRate data put Gnosis Pay at roughly 2,400 daily active cardholders and about $263,200 in transactions over the previous 24 hours)
• Decrypt, Crypto Card Provider Gnosis Pay Says Hackers Accessed Customer Data, November 6, 2026 (secondary reporting: physical attacks on crypto holders, including home invasions and kidnappings, were on pace for a record year after more than $30 million was stolen in the first half of 2026, according to Chainalysis; Coinbase said a breach at analytics vendor Amplitude exposed some customer contact data; Ledger said all confirmed cases in a suspected $87 million drain involved devices bought from CryptoBilis)

This article is news reporting and is not investment advice.