Gnosis Pay breach exposed full card numbers, CVV codes and wallet data

Crypto debit card provider Gnosis Pay disclosed a security breach on Friday that exposed customers' full payment card numbers, CVV codes, home addresses and linked cryptocurrency wallet addresses, according to breach notifications reviewed by Cointelegraph.

The company said it detected unauthorized access to its legacy consumer card system on Nov. 3 and began containing the incident within two hours. Customer funds remained safe, and the separate enterprise platform, which powers white-label card programs, was unaffected.

What data did the attackers access?

The exposed information went well beyond basic card metadata. According to the notifications, the compromised dataset included:

• Full payment card numbers, expiration dates and CVV codes
• Customer names and home addresses
• Cryptocurrency wallet addresses linked to affected accounts
• Email addresses, phone numbers and nationalities
• Banking details such as IBAN and BIC information in some cases

One notification confirmed that a customer's card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected. The company did not disclose how many customers were affected and did not immediately respond to a request for comment.

The scale of exposure is measurable through third-party data. OpenRate, a platform tracking crypto card activity, recorded roughly 2,400 daily active Gnosis Pay cardholders and $263,200 in processed transactions over the previous 24 hours — a user base whose sensitive financial identifiers may now circulate in criminal markets.

What has Gnosis Pay done in response?

The company said it replaced compromised security credentials and addressed the vulnerability that enabled the access. It also made 3D Secure verification mandatory for all online payments, an operational shift that adds a verification step to transactions but limits the usability of stolen card credentials.

The legacy consumer card system is scheduled for retirement on Dec. 20, according to the disclosure. That timeline gives affected customers a defined window during which the compromised infrastructure remains live, albeit with tightened controls.

Gnosis Pay also warned customers about phishing attempts that could leverage their exposed personal or transaction details, and said it was arranging monitoring for potential misuse of the stolen data. For a breach that included national identifiers and banking information alongside wallet addresses, that monitoring carries particular weight: cross-referenced personal and on-chain data enables targeted social engineering that generic card fraud does not.

The incident underscores an operational risk specific to crypto-card hybrids. A conventional card breach exposes payment rails; a breach at a provider like Gnosis Pay exposes the bridge between fiat card credentials and on-chain wallet addresses, potentially deanonymizing customers' blockchain activity.

Whether the mandatory 3D Secure regime holds until the Dec. 20 retirement, and whether monitoring detects misuse of the stolen IBAN and BIC data, will determine the breach's longer-term fallout.