Gnosis Pay Breach Exposes Card, Personal Data, and Crypto Wallets

Crypto-linked Visa debit card provider Gnosis Pay disclosed a security incident affecting its legacy consumer card system, stating that unauthorized access exposed customers’ payment card information alongside personal details and associated cryptocurrency wallet addresses.

In a public notice, the company said it detected the activity on Nov. 3 and began containment within two hours. Gnosis Pay added that customer funds were unaffected and that its separate enterprise platform—used to run white-label card programs—was not impacted.

Key takeaways

• Gnosis Pay reported a breach tied to its legacy consumer card system, not its enterprise/white-label infrastructure.
• Exposed data described in breach notifications includes full card numbers, expiration dates, CVV codes, and other personally identifiable information.
• The company said it replaced compromised credentials, patched the vulnerability, and enabled 3D Secure for online transactions until the legacy system is retired.
• Gnosis Pay did not publish the number of customers affected, but third-party tracking data suggests the platform services a relatively small active user base.

What Gnosis Pay says was exposed

According to Gnosis Pay’s disclosure, the incident stemmed from unauthorized access to its legacy consumer card environment. Breach notifications reviewed by Cointelegraph indicated that the exposed information could include:

• Payment card data such as full card numbers, expiration dates, and CVV codes
• Personal information including customer names, home addresses, and contact details
• Crypto linkage, with cryptocurrency wallet addresses associated with affected accounts
• Additional identifiers in some cases, such as email addresses, phone numbers, and nationalities
• In certain notifications, potential banking details like IBAN and BIC

One notification also indicated the customer’s card was canceled on Nov. 3, and it reported that no suspicious activity or movement of funds was detected.

Containment steps and short-term protection

Gnosis Pay said it moved quickly after detection, initiating containment within two hours of identifying the unauthorized access. The company also described remediation actions aimed at reducing the risk of further compromise.

Its steps included replacing compromised security credentials and addressing the underlying vulnerability. Additionally, Gnosis Pay said it made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20. That change is intended to add an extra authentication layer for card transactions conducted online.

The company also warned customers to watch for phishing attempts that may reference personal or transaction-related details from the breach. It said it is arranging monitoring to detect possible misuse of stolen data.

Impact to customers and the question of scale

While Gnosis Pay stated that customer funds were not affected, it did not disclose how many individuals were impacted. Cointelegraph reported that the company did not immediately respond to a request for additional comment.

That absence of a clear affected-customer figure matters for practical reasons: it affects how quickly customers and partners can assess exposure, determine whether they should replace cards, and decide how aggressively to monitor for fraud. Even if funds were not moved at the time of detection, the combination of card data and personal information increases the likelihood of follow-on attacks such as account takeovers, targeted phishing, or attempts to exploit the leaked crypto linkage.

For context on operational footprint, OpenRate data referenced by Cointelegraph put Gnosis Pay at roughly 2,400 daily active cardholders and about $263,200 in transactions over the previous 24 hours. These figures do not quantify breach scope, but they help readers gauge the platform’s recent activity level.

Why the “legacy system” distinction is significant

Gnosis Pay’s messaging draws a clear boundary: it said the breach affected its legacy consumer card system, while its separate enterprise platform supporting white-label programs was unaffected. This separation can be important for partners running their own card programs through the enterprise offering, because it implies they may face lower risk than consumers tied to the legacy environment.

Still, the incident highlights a common vulnerability pattern in payments infrastructure: older systems can remain high-value targets even when newer architectures exist alongside them. The company’s stated plan to retire the legacy system by Dec. 20 suggests the remediation timeline is anchored to removing the affected environment rather than simply limiting access indefinitely.

For customers, the immediate operational concern is not only whether unauthorized payments occurred, but whether exposed credentials and identifying data could be reused later. The breach notification also reportedly included cryptocurrency wallet addresses, which can elevate the stakes for account association and targeted scams, particularly where funds management and identity verification overlap.

Going forward, readers should watch for additional details from Gnosis Pay about the affected population, confirmation of whether any fraudulent transactions occurred after card cancellation steps, and evidence that the enhanced online verification controls (3D Secure) reduce risk through the legacy system’s retirement window.