Crypto cards connect crypto services with card payments, but that use case carries a security obligation beyond protecting customer funds: safeguarding the personal information held by the card service.
A Gnosis Pay disclosure illustrates that distinction. As reported by Decrypt on November 7, 2026, at 00:41:29 UTC+8, the company said hackers accessed customer information through the system powering its own branded cards. Gnosis Pay said customer funds were not affected.
What was affected—and what was not
According to Gnosis Pay, its monitoring systems detected unauthorized access on November 3, and containment began within two hours. The company said it subsequently replaced compromised security credentials and fixed the vulnerability.
The breach affected only its consumer business, whose platform was already scheduled to retire on December 20. Gnosis Pay said its enterprise platform—which powers white-label card programs for fintech firms, wallets and neobanks—was not affected. That distinction matters: the disclosure concerned the company’s branded consumer cards, not every card program using its infrastructure.
Gnosis Pay did not publicly disclose how many customers were affected or specify what information was exposed. It said each affected customer received an email detailing what had been taken from their account.
“While funds were not affected, the security of personal information is just as important and we take full responsibility,” the company wrote on X on November 6, 2026.
The constraint behind the payment use case
The incident separates two risks that can be blurred in discussions of crypto payments: loss of funds and exposure of customer data. Gnosis Pay reported no impact on funds, but warned customers to watch for unexpected messages about their cards—even messages containing genuine personal information or purchase details.
The company said it would never request seed phrases, PINs or full card numbers, or ask customers to move funds. It also advised caution when sharing home addresses or details of crypto holdings, online or offline.
Those warnings identify a practical constraint on the crypto-card proposition: keeping funds intact does not eliminate the potential consequences of a data breach. The disclosure does not, however, establish whether crypto-card adoption is growing or shrinking, or whether other providers face the same vulnerability.
Response and remaining unknowns
Gnosis Pay said it increased monitoring of card activity and wallets for fraud and made 3D Secure, an additional verification step, mandatory for all online card payments until the consumer platform’s retirement. It also said it notified partners, its card issuer and data protection authorities, and was arranging specialist monitoring for potential misuse of the exposed data.
The public disclosure leaves the scale and precise contents of the exposure unspecified. For assessing this incident, those limits matter alongside the company’s assurances about funds and its unaffected enterprise platform.
