For holders using a crypto debit card, protecting funds and protecting personal information are separate concerns. Gnosis Pay said a breach of its legacy debit-card system exposed certain customer information, but did not affect customer funds.
The Block reported the disclosure on Nov. 7, 2026, at 02:57:56 UTC+8. This account reflects that original reporting context.
What Gnosis Pay reported
Gnosis Pay detected unauthorized access on Nov. 3 in the legacy system supporting its Gnosis Pay-branded debit cards. The company said it contained the incident within two hours, replaced compromised security credentials and addressed the vulnerability.
According to Gnosis Pay, its enterprise platform, which powers white-label card programs, was not affected. The supplied report did not specify which customer information was exposed or how many customers were affected.
Online payments required an additional check
Following the breach, Gnosis Pay made 3D Secure verification mandatory for online card payments until the affected system’s scheduled retirement on Dec. 20.
The distinction matters: the company’s statement that funds were unaffected does not mean customer information remained confidential. Its reported containment measures and payment-verification requirement address different aspects of the incident.
Other card incidents involved different risks
The Block placed the disclosure alongside other incidents involving crypto-card infrastructure:
- Based: The company said an attacker accessed an internal dashboard used to manage its Visa card program on Oct. 5. Some customer data was exposed, but the attacker reportedly failed to access deposited funds.
- Rain infrastructure: In August, a vulnerability in Rain’s Solana card infrastructure allowed unauthorized withdrawals from card balances belonging to Tria and Avici users.
- Revolut: The company said an unauthorized third party used a fraudulent request from a legitimate government email domain to obtain sensitive customer information. This potentially included account statements, identity documents and Bitcoin transaction histories. Revolut said customer funds and systems were unaffected.
These reports should not be treated as equivalent outcomes. Gnosis Pay reported customer-data exposure without affected funds; the Rain infrastructure incident involved unauthorized withdrawals. For long-term holders, that is an important distinction when reading a provider’s security notice.
Original source: The Block — Gnosis Pay data breach exposes customer info; funds unaffected. Published Nov. 7, 2026, at 02:57:56 UTC+8.