Gnosis Pay confirmed on November 6, 2026, that unauthorized access to its consumer-card system exposed customer information. For one cardholder, Rotki founder Lefteris Karapetsas, the exposed data tied his home address to every wallet linked to his account.
What Happened?
- Gnosis Pay detected the intrusion on November 3 and began containment within two hours, according to its incident notice.
- Customer funds were not affected, the company said, and its enterprise platform for white-label card programs stayed untouched.
- Every affected customer received an email listing the stolen details, but Gnosis Pay has not disclosed how many people were hit.
- 3D Secure, an extra checkout verification step, is now mandatory for all online card payments until the consumer system closes.
The intrusion stayed inside Gnosis Pay’s own card system
Gnosis Pay, which runs Visa debit cards that spend directly from self-custodial wallets, disclosed the breach in an incident notice on its blog. Its security team replaced the affected credentials and addressed the vulnerability. The notice does not say what that vulnerability was.
The breach was confined to the B2C (business-to-consumer) system behind Gnosis Pay-branded cards. That system was already scheduled for retirement before the intrusion. The company apologized and said that, even with funds safe, “the security of personal information is just as important.“
Gnosis Pay has reported the breach to its partners and is in contact with the relevant data protection authorities and its card issuer. It is also running a full review and arranging specialist monitoring for signs the exposed data is being misused.
Exposure varied by account. Karapetsas said on X that his name, home address, card number and all linked wallet addresses were exposed, as first reported by The Defiant. He wrote that Gnosis Pay had already lost him as a user but could at least have protected his data. A notice sent to a Protos journalist listed a narrower set: the name printed on the card, a shipping address and an account reference.
We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information. Everyone affected was sent an email today with full information. We deeply regret that this happened. While funds were not affected, the security of personal information is just as important and we take full responsibility. Additional measures are in place until the B2C platform involved is fully retired as planned on 20 December 2026. In the meantime we encourage everyone to be even more vigilant. We will never ask for your PIN or seed phrase, or ask you to move funds. Further Details: https://t.co/rZoZ4hbqan We encourage security researchers to communicate security vulnerabilities directly with us via bounty@gnosis.io. The same rewards apply as to Gnosis Chain: https://t.co/t8EnMI0fyF
— Gnosis Pay 💳 (@gnosispay) November 6, 2026
A home address tied to public wallets
That pairing is what separates this breach from a routine card leak. Gnosis Pay cards spend from Safe wallets on Gnosis Chain, a public blockchain where anyone holding an address can read its balance and history. Add a name and a street address, and the record shows who holds what and where they live. The company’s own guidance reflects that risk, telling customers to guard their address and holdings offline as well as online.
This is Gnosis Pay’s second incident since June 1, when an attacker exploited a vulnerability in its Delay and Roles modules. The company’s post-mortem put the haul at about $1.5 million across roughly 5,281 wallets holding at least $1. Gnosis absorbed those losses, so no user lost funds. A refund can make a drained wallet whole again, but nobody can reissue a home address.
Gnosis Pay’s notice leaves several questions open:
- How many cardholders were affected?
- What vulnerability allowed the access, and how long was it open before November 3?
- Has any of the exposed data surfaced for sale?
- When will the full review conclude, and will its findings be published?
The company’s guidance for affected cardholders is specific. It tells them to treat any unexpected email, text, call or letter about Gnosis Pay or a partner app as suspect. That holds even when the message includes real details or a real purchase. Those details are exactly what makes phishing and wallet-drainer attacks convincing.
Neither Gnosis Pay nor its partner apps will ask for a seed phrase, private keys, PIN or full card number, the company said. It added that it will never ask customers to move funds by email, text or phone.
Gnosis Pay cards stop authorizing transactions at 23:59 UTC on December 20, under a September 21 closure notice. The web app closes at the same moment, except for withdrawals. Card issuer Monavate keeps transaction records for the period required by law.
