Gnosis Pay Data Breach Exposes Customer Information Through Legacy Card System

Gnosis Pay Data Breach Reveals Security Risks in Crypto Payment Cards

The Gnosis Pay data breach has exposed a serious privacy vulnerability in cryptocurrency payment infrastructure, demonstrating that users can face security risks even when their digital assets remain safely stored in self-custodial wallets.

On November 6, 2026, Gnosis Pay confirmed that attackers had gained unauthorized access to an older system supporting its consumer debit cards.

The company detected the intrusion on November 3 and began containing the incident within two hours.

According to its official disclosure, the attackers accessed certain customer information, although Gnosis Pay has not publicly identified the total number of affected users or released a complete breakdown of every compromised data category.

The company emphasized that its enterprise platform, which supports payment card programs for other businesses, was not affected.

It also stated that customer funds remained secure.

However, the incident raises questions about the personal information collected by cryptocurrency payment providers and the potential consequences when those records are exposed.

Unlike a typical wallet exploit, the latest attack appears to have targeted customer data rather than directly stealing cryptocurrency.

That difference is important because the consequences of exposing personal information can continue long after a technical vulnerability has been fixed.

How Hackers Accessed Gnosis Pay's Legacy Card System

Gnosis Pay's security monitoring systems detected unauthorized access on November 3, 2026.

The company has not publicly disclosed the complete technical method used by the attackers.

However, it confirmed that the intrusion affected the legacy infrastructure supporting its consumer-facing payment cards.

Following detection, the security team initiated containment procedures within approximately two hours.

The company subsequently replaced affected security credentials and addressed the vulnerability.

These actions were intended to prevent further unauthorized access.

Gnosis Pay also increased monitoring of card transactions and cryptocurrency wallets to identify suspicious activity.

One of the most significant changes was the introduction of mandatory 3D Secure verification for online card payments.

This additional authentication requirement will remain in place until the legacy consumer card system is retired.

The company has already scheduled that retirement for December 20, 2026.

Importantly, the affected infrastructure is separate from Gnosis Pay's enterprise white-label card platform.

According to the company, that enterprise system was not compromised.

The distinction matters because Gnosis Pay operates both consumer products and infrastructure used by other businesses.

A security incident affecting one system does not necessarily mean every service operated by the company has been breached.

What Customer Information Was Exposed?

The full extent of the data exposure remains uncertain.

Gnosis Pay has confirmed that certain customer information was compromised, but it has not published a complete list of affected data categories for all users.

However, one customer has publicly described the information exposed in his account.

Lefteris Karapetsas, the founder of cryptocurrency portfolio management platform Rotki, said the compromised information included his name, residential address, card number, and cryptocurrency wallet addresses connected to his Gnosis Pay account.

This disclosure is significant because it illustrates how a payment card database can connect real-world identities with blockchain activity.

A cryptocurrency wallet address may appear pseudonymous when viewed independently on a public blockchain.

However, if that address becomes associated with someone's name and home address, the privacy implications change considerably.

An attacker could potentially use the information to identify a wallet owner, examine publicly visible transaction activity, or create convincing fraudulent communications.

There is currently no confirmed evidence that the Gnosis Pay breach has resulted in such secondary attacks.

Nevertheless, the exposure creates risks that affected customers should take seriously.

Gnosis Pay has not publicly confirmed whether all customers experienced the same categories of data exposure.

It also has not established that card security codes, PINs, seed phrases, or private keys were compromised.

Those details should not be assumed without further evidence.

Why Self-Custody Could Not Prevent the Data Breach

One of the most important lessons from the incident concerns the difference between cryptocurrency custody and personal data security.

Gnosis Pay has promoted a model that allows users to maintain control over cryptocurrency assets while accessing conventional payment services.

Self-custody means that users retain control of the credentials or authorization mechanisms governing their digital assets.

This can reduce dependence on a centralized exchange or payment company holding funds directly.

However, self-custody does not prevent a payment provider from collecting personal information.

Financial services commonly require identity verification, transaction records, billing information, and cardholder details to satisfy operational and regulatory requirements.

Even when cryptocurrency remains under the user's control, some personal information may still be stored in centralized databases.

If those databases are compromised, attackers may obtain sensitive information without accessing the underlying wallets.

This creates two separate security responsibilities.

The first involves protecting cryptocurrency from unauthorized transfers.

The second involves protecting the identity and financial information associated with the person controlling those assets.

A platform can successfully protect customer funds while failing to protect customer privacy.

That is precisely why the latest Gnosis Pay incident deserves attention.

Bitnxt previously examined related operational security concerns in its coverage of Binance's fake job interview attack and major cryptocurrency security breach.

Although the attacks involved different methods, both illustrate how criminals can target supporting infrastructure rather than attempting to defeat blockchain cryptography directly.

Gnosis Pay Introduces Mandatory 3D Secure Authentication

Following the breach, Gnosis Pay introduced additional security measures intended to reduce the risk of fraudulent card transactions.

The most visible change is mandatory 3D Secure authentication for online card payments.

3D Secure is an additional verification process used in card-not-present transactions.

Depending on the issuer and transaction, customers may be asked to confirm their identity through an application, biometric authentication, or another supported method.

This can make it more difficult for criminals to complete unauthorized online purchases using compromised card information.

However, 3D Secure is not a complete solution to every form of card fraud.

Some transactions may follow different authentication procedures, and attackers may attempt social engineering to persuade users to approve fraudulent payments.

Gnosis Pay has also increased monitoring of card activity and associated wallets.

The company says it is arranging specialist monitoring to identify potential misuse of information exposed in the breach.

Affected customers have been contacted individually by email with details about the information compromised in their accounts.

Gnosis Pay has additionally informed relevant partners, card issuers, and applicable data protection authorities.

The company has not publicly established that these measures eliminate every possible risk resulting from the incident.

The November Breach Is Separate From Gnosis Pay's $1.5 Million June Exploit

The latest incident is not Gnosis Pay's first significant security problem in 2026.

On June 1, attackers exploited a vulnerability affecting software modules used in the Gnosis Pay card wallet infrastructure.

That attack involved the Zodiac Delay Module and Roles Module.

The vulnerability allowed attackers to exploit a weakness in how certain smart contracts validated digital signatures.

According to Gnosis's official post-mortem, the attackers withdrew approximately $1.5 million in cryptocurrency.

An additional $300,000 became temporarily inaccessible.

The incident affected thousands of wallet accounts, although not every affected wallet experienced a direct theft.

Gnosis responded by suspending services, repairing the vulnerable modules, coordinating with security partners, and restoring customer balances.

The company subsequently confirmed that it had absorbed the losses and reimbursed affected users.

By June 6, services had been restored for approximately 99% of users, with remaining accounts restored afterward.

How the Two Incidents Differ

The two incidents should not be presented as a single continuing attack.

There is no verified evidence establishing that the same attackers were responsible.

However, their occurrence within the same year raises important questions about security governance across different parts of a cryptocurrency payment business.

Bitnxt Take: Protecting Crypto Funds Is Only Half the Security Challenge

At Bitnxt, we believe the most important lesson from the Gnosis Pay incident is that cryptocurrency security must be evaluated beyond whether funds were stolen.

For years, much of the industry's security discussion has focused on private keys, wallet vulnerabilities, exchange hacks, and smart contract exploits.

Those risks remain important.

However, as cryptocurrency becomes integrated into everyday financial services, companies increasingly handle sensitive personal information alongside blockchain transactions.

This creates a different category of exposure.

A wallet address by itself may not reveal who owns it.

But when that address is linked to a real name, residential address, and payment card information, the potential consequences become much more serious.

An attacker may be able to build a detailed profile of a cryptocurrency user without ever compromising their private keys.

Our assessment at Bitnxt is that the next generation of cryptocurrency payment platforms must treat personal data protection as seriously as digital asset custody.

The fact that Gnosis Pay says customer funds were unaffected is an important positive distinction.

However, it does not remove the risks associated with exposed identity information.

We also believe the incident highlights the importance of managing older technology.

The affected consumer card infrastructure was already scheduled for retirement.

That raises a broader operational question: how should companies protect legacy systems while customers continue using them?

Retiring outdated infrastructure is important, but organizations must maintain effective monitoring, access controls, and vulnerability management until those systems are fully decommissioned.

The latest incident also reinforces the need for clear communication.

Affected customers require specific information about what was exposed, what risks they face, and what practical actions they should take.

A general assurance that funds remain secure is useful, but it cannot replace a detailed explanation of the privacy impact.

Why Linked Wallet Addresses Create Additional Security Risks

Public blockchain transactions can often be examined using blockchain explorers.

Depending on the network, an observer may be able to view transaction histories, token transfers, and wallet balances.

However, public addresses do not always reveal the identity of their owners.

That changes when customer records connect blockchain addresses to verified personal information.

If attackers obtain both types of data, they may be able to associate financial activity with specific individuals.

For example, a criminal who knows someone's residential address and cryptocurrency wallet information could potentially use that knowledge to create targeted scams.

They might send fraudulent messages claiming to represent a payment provider or wallet support service.

They could also reference real transaction details to make those messages appear more credible.

In more serious circumstances, exposed information about cryptocurrency holdings could create physical-security concerns.

However, the ability to inspect a wallet address does not automatically establish ownership of every associated asset.

Some addresses may belong to shared services, smart contracts, or other arrangements that make balances difficult to attribute to a particular individual.

There is also no verified evidence that attackers have used the Gnosis Pay data to conduct physical attacks.

The concern is about the increased risk created when sensitive information becomes available to unauthorized parties.

Gnosis Pay's Consumer Card Shutdown Adds Another Dimension

The breach occurred shortly before the planned retirement of Gnosis Pay's consumer card service.

The company previously announced that its existing consumer cards would stop functioning at 23:59 UTC on December 20, 2026.

The shutdown was announced before the November data breach.

Therefore, it would be inaccurate to describe the security incident as the reason for the retirement decision.

Gnosis Pay has been shifting its business toward infrastructure that allows other companies to offer cryptocurrency-linked payment cards.

Its enterprise white-label platform supports that strategy.

The company says the enterprise infrastructure was not affected by the November breach.

However, the timing of the incident may increase attention on how securely the company manages the transition away from its legacy consumer system.

Customers will need clear guidance about card functionality, remaining balances, withdrawals, and account access during the transition.

According to the company's earlier announcement, the web application will remain available for withdrawals after the consumer cards stop working.

The planned retirement also creates an opportunity for Gnosis Pay to reduce the operational complexity associated with maintaining older infrastructure.

Whether the new business model improves long-term security will depend on the controls, monitoring, and independent assessments applied to its enterprise platform.

Crypto Card Spending Grows Despite Gnosis Pay's Decline

The Gnosis Pay incident comes during a period of expanding cryptocurrency-linked payment activity.

According to data cited in the November 7 report, Gnosis Pay's monthly card spending declined from approximately $12.05 million in October 2025 to $6.1 million in October 2026.

That represents a decrease of roughly 49%.

The decline began before the latest breach and should not be attributed to the November incident.

Meanwhile, broader cryptocurrency card spending reportedly increased from approximately $464 million to $1.37 billion over the same period.

This contrast suggests that Gnosis Pay's consumer card business was losing momentum even as the wider market expanded.

Traditional payment companies are also increasing their involvement in blockchain-based settlement.

Bitnxt recently reported that Visa's stablecoin settlement business surpassed a $25 billion annualized run rate.

That development illustrates how stablecoins are becoming part of established payment infrastructure.

However, the Visa figure measures an annualized settlement pace rather than total consumer card spending.

The two metrics should not be directly compared.

For cryptocurrency payment providers, growing adoption creates both opportunities and responsibilities.

As more consumers use digital assets for everyday purchases, providers must protect not only transactions and funds but also the personal information required to operate payment services.

What Gnosis Pay Customers Should Do After the Breach

Gnosis Pay has advised customers to remain alert for suspicious communications following the incident.

The company warns that attackers may use genuine personal details or transaction information to make fraudulent messages appear trustworthy.

Affected users should therefore avoid following unexpected links received through email, text messages, or other communications.

Instead, account activity should be checked through the official Gnosis Pay application or a verified partner application.

Customers should never disclose recovery phrases, private keys, PINs, or complete card details in response to unsolicited messages.

Gnosis Pay has emphasized that it will not request these credentials or instruct users to transfer funds through email, text messages, or telephone calls.

Users who receive a direct notification about exposed card information should follow the specific instructions provided through verified company channels.

Depending on the data involved, it may also be appropriate to contact the card issuer about additional monitoring or replacement options.

However, there is no basis for assuming that every customer must immediately move cryptocurrency to a different wallet.

The company has not reported a compromise of wallet private keys or seed phrases in the November incident.

Moving funds unnecessarily could introduce additional transaction risks and costs.

The appropriate response depends on the specific information exposed.

What the Incident Means for the Future of Crypto Payment Cards

Cryptocurrency payment cards are designed to connect blockchain assets with conventional financial services.

They can make digital assets more useful by allowing customers to spend funds through familiar payment networks.

However, this integration creates dependencies on payment processors, card issuers, identity verification providers, and customer databases.

Each additional component can introduce security responsibilities.

A blockchain transaction may be secure while the surrounding payment infrastructure remains vulnerable.

This is why cryptocurrency payment companies need a broader approach to risk management.

Strong smart contract audits are important, but they cannot replace database security, employee access controls, credential management, and privacy protections.

Similarly, self-custodial wallet technology does not remove the need to protect customer identity records.

Bitnxt previously explored the importance of trusted wallet infrastructure in its report on a Coldcard software vulnerability linked to approximately $100 million in stolen Bitcoin.

The Coldcard case involved a different type of security weakness, but it reinforces the same principle: users depend on the security of the technology and services surrounding their digital assets.

For Gnosis Pay, the immediate challenge is completing its investigation, supporting affected customers, and securely retiring the legacy system.

For the wider industry, the incident provides another reason to examine how cryptocurrency payment providers collect, retain, and protect personal information.

What Happens Next in the Gnosis Pay Investigation?

Several important questions remain unanswered.

Gnosis Pay has not publicly disclosed the total number of affected customers.

It has also not released a complete technical explanation of how attackers initially gained access to the legacy system.

The company says it has addressed the vulnerability and replaced affected credentials.

However, an independent public forensic report confirming the full scope of the intrusion has not yet been released.

Gnosis Pay is conducting a broader review and has stated that it will apply lessons from the incident across its systems.

It is also working with relevant partners and data protection authorities.

The next developments to monitor include any additional disclosures about affected customer records, evidence of data misuse, and the results of the company's security review.

The planned December 20 retirement of the legacy consumer card platform will also be an important operational milestone.

Final Thoughts

The Gnosis Pay data breach highlights a security challenge that becomes increasingly important as cryptocurrency moves into mainstream payments.

The company has confirmed unauthorized access to its legacy consumer card infrastructure, resulting in the exposure of certain customer information.

Although Gnosis Pay says customer funds and its enterprise platform were not affected, the incident demonstrates how personal information can remain vulnerable even when cryptocurrency is held through self-custodial arrangements.

The breach also follows a separate June 2026 smart contract exploit, making security oversight an important issue for the company.

Bitnxt believes the future of cryptocurrency payments will depend not only on secure blockchain transactions but also on strong privacy protections, transparent incident reporting, and reliable operational infrastructure.

As crypto-linked cards become more widely used, protecting the people behind wallet addresses will be just as important as protecting the assets those wallets hold.