Gnosis Pay’s disclosure of a breach in its legacy consumer card system highlights a risk at the intersection of crypto wallets and everyday payments: exposed records can connect wallet addresses with customers’ identities, home addresses and payment credentials.
In reporting published on Nov. 7, 2026, at 04:51:23 UTC+8, Cointelegraph said the crypto-linked Visa debit card provider disclosed the breach on Friday. Gnosis Pay said it detected unauthorized access on Nov. 3 and began containing it within two hours. The company said customer funds and its separate enterprise platform, which powers white-label card programs, were unaffected.
What information was exposed?
According to breach notifications reviewed by Cointelegraph, the exposed information included:
- Full payment card numbers, expiration dates and CVV codes.
- Customer names, home addresses and cryptocurrency wallet addresses linked to affected accounts.
- Email addresses, phone numbers and nationalities.
- In some cases, banking details, including IBAN and BIC information.
One notification confirmed that a customer’s card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected. That account-specific notification does not establish the outcome for every affected customer. Gnosis Pay did not disclose how many customers were affected and had not immediately responded to Cointelegraph’s request for comment.
Containment and the legacy system’s retirement
Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20.
The company also warned customers about phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.
Payment activity is not a measure of breach scope
OpenRate, a third-party platform tracking crypto card activity, put Gnosis Pay at around 2,400 daily active cardholders, with $263,200 in transactions over the preceding 24 hours. Those figures describe payment activity, not the number of customers whose information was exposed.
The distinction matters for the crypto-payments narrative: reported protection of customer funds does not mean customer data remained protected. Here, the disclosed exposure included both conventional financial credentials and wallet-linked personal information, while the scale of the affected customer population remained undisclosed.
