Gnosis Pay breach exposed addresses and linked wallets

Gnosis Pay said its monitoring detected unauthorized access on November 3, exposing personal details and linked wallets through its legacy direct-to-consumer card system without moving customer funds. In a November 6 company post, the firm said containment began within two hours of detection. Gnosis Pay replaced affected security credentials and fixed the flaw. A matching X statement repeated those points.

The affected stack powers Gnosis Pay-branded consumer cards and was weeks from its scheduled shutdown on December 20, 2026. The company’s separate enterprise white-label platform was not affected, and partner card programs run on that platform. That distinction limits the breach to the direct-to-consumer line.

Exposure was not identical for every customer. Gnosis Pay’s public post described only certain customer information. The company said it emailed every affected customer, with each notice listing the fields taken from that account. It also reported the incident to partners, the card issuer and data protection authorities.

Rotki founder Lefteris Karapetsas published the details of his notice on X. It named his full home address and name, his card number and every wallet linked to the account. For a self-custody payments product, that combination creates a KYC-grade paper trail beside on-chain identifiers, raising the risk of targeted phishing even where the money never moved.

The incident joins recent crypto hacks that caused no wallet drain but still exposed usable personal data. In those cases, and here, attackers did not need to drain a balance to impersonate a brand. They can cite a genuine address or recognizable card-digit pattern, then request a “security check” that is really an attempt to harvest a seed phrase. That follow-up can arrive after Gnosis Pay closes the original access route, so the breach may continue through customer contact rather than direct theft.

What does this change for Gnosis Pay cardholders?

Until the legacy system closes on December 20, 2026, affected users should treat every unexpected email, text, call or letter as suspect. That includes messages mentioning Gnosis Pay, a partner app or the card. Gnosis Pay said correct information inside a message does not make it safe. Its instruction was blunt: “Do not click those links.”

Customers should use only the official web app or partner app. They should “Never share a seed phrase, private keys, PIN, or full card number.” Gnosis Pay said it will never request those credentials, ask for identity re-verification by email or text, or ask customers to move funds over those channels. Accurate details do not make such requests legitimate.

The company said it increased monitoring of card activity and wallets. It also made 3D Secure mandatory for all online card payments, and said that requirement remains until the legacy stack retires. It is arranging specialist monitoring for misuse of the leaked data. Gnosis Pay also apologized for the personal data exposure.

These controls strengthen transaction checks, but they do not erase exposed names, addresses, card numbers or wallet links. The enterprise platform and its partner programs were outside the affected stack. Direct Gnosis Pay cardholders still face impersonation risk while the consumer system remains available. Customers should rely on the fields listed in their notices.

The consumer stack is retiring, but not yet retired. The planned replacement of the legacy stack does not protect customers who remain on it before shutdown. That leaves Gnosis Pay responsible for keeping heightened monitoring and mandatory 3D Secure in place through the final stretch, while customers remain alert to impersonation attempts that can use real account details.

The next hard deadline is December 20, 2026. Until then, affected cardholders should use only the official apps and refuse credential requests over email or text, even if a sender cites real account information.