For Gnosis Pay cardholders, the reported breach raises a personal-information concern rather than a confirmed loss of funds. The company said attackers accessed customer information through the system behind its own branded cards, while customer funds were not affected.
Decrypt reported the disclosure in an article published on November 7, 2026, at 00:41:29 UTC+8. Gnosis Pay’s public statement was dated November 6, 2026.
What was affected—and what remains unclear
According to Gnosis Pay, its monitoring systems detected unauthorized access on November 3, and containment began within two hours. The company said it subsequently replaced compromised security credentials and fixed the vulnerability.
The breach was limited to its consumer business, whose platform was already scheduled to retire on December 20. Gnosis Pay said its enterprise platform, which supports white-label card programs for fintech companies, wallets and neobanks, was not affected.
The company did not publicly disclose how many customers were affected or which types of information were exposed. It said each affected customer received an email detailing what had been taken from their account.
“While funds were not affected, the security of personal information is just as important and we take full responsibility,” Gnosis Pay wrote on X.
The precautions Gnosis Pay announced
The company said it had increased monitoring of card activity and wallets for fraud. It also made 3D Secure, an additional verification step, mandatory for all online card payments until the consumer platform’s retirement.
Gnosis Pay said it notified its partners, card issuer and data protection authorities, and was arranging specialist monitoring for signs of misuse of the exposed information.
What cardholders were told to watch for
Gnosis Pay urged customers to be cautious about unexpected messages concerning their cards—even messages containing genuine personal information or purchase details.
The company said it would never ask customers for:
- Wallet seed phrases;
- PINs or full card numbers;
- Transfers of funds.
It also cautioned customers about sharing their address or details of their crypto holdings, whether online or offline. The practical distinction is important: the company’s statement that funds were unaffected does not mean the exposure of personal information carries no risk.