Crypto-linked debit card provider Gnosis Pay disclosed a security incident that it says exposed sensitive customer payment and personal data, along with cryptocurrency wallet addresses, after unauthorized access was detected in a legacy consumer card system.

In a notice posted on its website, Gnosis Pay said it identified the breach on Nov. 3 and moved to contain it within about two hours. The company emphasized that customer funds and its separate enterprise platform—used for white-label card programs—were not affected.

Key takeaways

Gnosis Pay reported unauthorized access to a legacy consumer card system beginning Nov. 3 and containment within roughly two hours.
The exposed information, according to breach notifications reviewed by Cointelegraph, included full card numbers, expiration dates, and CVV codes.
Beyond payment data, notifications indicated exposure of home addresses and cryptocurrency wallet addresses tied to affected accounts.
Gnosis Pay stated no suspicious transactions or fund movement were detected, and one notification indicates affected cards were canceled on Nov. 3.
The company says it has replaced compromised security credentials, fixed the vulnerability, and temporarily strengthened online-payment verification until a scheduled legacy-system retirement on Dec. 20.

What Gnosis Pay says was compromised

Gnosis Pay’s disclosure points to a breach confined to its legacy consumer card system, not to the company’s separate enterprise platform. In its blog post, the provider said it discovered unauthorized access on Nov. 3 and began containing the incident within two hours.

Gnosis Pay added that customer funds were unaffected and that its enterprise system—described as powering white-label card programs—also remained unaffected.

However, breach notifications reviewed by Cointelegraph suggest the scope of exposed data was extensive for users tied to the affected consumer cards.

The types of data listed in breach notifications

According to the notifications Cointelegraph reviewed, the exposed records included:

Payment card details: full payment card numbers, expiration dates, and CVV codes.
Personal information: customer names and home addresses.
Crypto identifiers: cryptocurrency wallet addresses linked to affected accounts.
Additional contact and demographic details: email addresses, phone numbers, and nationalities.
Some banking data: in certain cases, information such as IBAN and BIC.

One notification, reviewed by Cointelegraph, also confirmed that a customer’s card was canceled on Nov. 3 and noted that no suspicious transactions or movement of funds were detected.

Containment steps and planned system retirement

In its disclosure, Gnosis Pay said it took several remediation actions. The company stated that it replaced compromised security credentials and addressed the underlying vulnerability.

To reduce the risk of fraudulent online payments while the affected system remains in operation, Gnosis Pay said it made 3D Secure verification mandatory for online transactions. The company also tied these changes to a broader timeline, noting that the legacy system is planned to be retired on Dec. 20.

Gnosis Pay also warned customers about potential phishing attempts that may reference personal or transaction details. The provider said it is arranging monitoring intended to identify misuse of stolen data.

How widely used Gnosis Pay’s card service appears to be

While Gnosis Pay did not disclose how many customers were affected, third-party analytics offered a glimpse of user activity around the time of the disclosure. According to OpenRate data cited by Cointelegraph, Gnosis Pay had roughly 2,400 daily active cardholders and processed about $263,200 in transactions over the prior 24 hours.

That snapshot doesn’t quantify the number of impacted accounts, but it does help contextualize the operational footprint of the program and why a breach involving both card credentials and wallet addresses could matter to a broad set of users—even if confirmed financial exposure is limited.

What to watch next

For affected customers and users of crypto-linked card programs more broadly, the immediate priorities are confirmation of whether cards were canceled or credentials reissued, ongoing monitoring for fraudulent attempts, and how effectively providers prevent phishing from exploiting exposed personal and transaction details as the legacy system approaches its planned retirement on Dec. 20.