For crypto holders using Gnosis Pay, the disclosed breach raised a privacy concern even though the company said customer funds were unaffected: exposed payment and identity information included cryptocurrency wallet addresses linked to affected accounts.
Cointelegraph reported the disclosure on Nov. 6, 2026. The original publication timestamp supplied with the article is Nov. 7, 2026, at 04:51:23 UTC+8.
What information was exposed?
Gnosis Pay, a crypto-linked Visa debit card provider, said it detected unauthorized access to its legacy consumer card system on Nov. 3 and began containing the breach within two hours. The company said its separate enterprise platform, which powers white-label card programs, was unaffected.
According to breach notifications reviewed by Cointelegraph, the exposed information included:
- Full payment card numbers, expiration dates and CVV codes
- Customer names, home addresses and linked cryptocurrency wallet addresses
- Email addresses, phone numbers and nationalities
- In some cases, banking details such as IBAN and BIC information
Gnosis Pay did not disclose how many customers were affected. One notification confirmed that a customer’s card was canceled on Nov. 3 and that no suspicious transactions or movement of funds had been detected for that customer. That individual notification should not be read as a separate finding covering every affected account.
What Gnosis Pay said it changed
The company said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20.
It also warned customers about phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.
For affected holders, the distinction is important: the company’s statement that funds were unaffected does not mean the exposed personal and financial information cannot be misused. Its warning specifically concerned phishing messages that could draw on those details to appear credible.
What remains unknown
Cointelegraph reported that Gnosis Pay did not immediately respond to its request for comment. The number of affected customers remained undisclosed.
For context, third-party crypto card activity tracker OpenRate recorded around 2,400 daily active Gnosis Pay cardholders and $263,200 in transactions over the preceding 24 hours. Those activity figures are not a count of affected customers or a measure of losses.