Gnosis Pay said in its November 6 disclosure that its monitoring detected unauthorized access on November 3 to the system behind its own branded cards, with containment starting within two hours. The company reported that customer funds and its enterprise platform were unaffected, but notices sent to affected customers list personal details ranging from card numbers to home addresses and linked crypto wallets.

A Breach Inside a Product Already Being Retired

The affected system runs Gnosis Pay's consumer business: the Visa debit cards sold under its own name and issued by Monavate, an e-money firm authorized by the UK's Financial Conduct Authority. The company had already scheduled that system for retirement on December 20. It is moving to its enterprise platform, which runs white-label card programs for other businesses and, according to Gnosis Pay, was not affected.

Gnosis Pay says it replaced the compromised credentials, fixed the vulnerability, and emailed every affected customer a list of exactly what was taken from their account.

This is the card product's second security incident this year. In June, attackers exploited a flaw in wallet software modules used by Gnosis Pay accounts and extracted about $1.5 million. Gnosis absorbed those losses and restored user funds, according to its post-mortem. The two incidents differ in kind: June's attackers went directly for funds, while the November intrusion went for account data.

One of the November notices has been made public. Lefteris Karapetsas, founder of portfolio tracker Rotki, shared his email on X. CoinDesk reported that it listed his name, full home address, card number, and every wallet address linked to his account. He told the company it "could have at least protected my data." Other customers' emails may list different fields, so each person's own notice, not the public statement, shows what they need to act on.

The Card Number Problem Ends on December 20

A leaked card number creates one immediate risk: online purchases made with the card details alone. Gnosis Pay's main fix targets exactly that. The company has made 3D Secure, the check Visa brands as Visa Secure, mandatory for all online card payments. This lets the card issuer require approval from the cardholder before a purchase goes through. Gnosis Pay has also stepped up fraud monitoring of card and wallet activity.

The company says both measures stay in place until the consumer system shuts down. After December 20, a leaked number belongs to a card that no longer works, so this part of the exposure has a fixed end date.

The Wallet Link Has No End Date

The rest of the leaked record does not lapse with the card. A wallet address is public by design: anyone can open a block explorer and see its balance and full transaction history. What an address normally lacks is a name. A record pairing it with a person's identity and home address supplies that missing piece, and the pairing stays valid for as long as the wallet is in use. That pairing is inherent to regulated card programs, which must verify a customer's identity before they can issue a card.

That does not put funds within reach of whoever holds the data. Gnosis Pay's support guidance says it has never held customers' keys, so the breached system could not contain them, and nobody can spend from an address just by knowing it.

What the record offers an attacker is targeting: who to approach, where they live, and what they appear to hold. The company's own disclosure points the same way, telling customers to be careful who they share their address or holdings with, online and offline.

Crypto has a precedent for how long that kind of data stays useful. In December 2020, a database stolen from hardware wallet maker Ledger was dumped online. The company confirmed it contained about 272,000 customer records with names, postal addresses, and phone numbers. Ledger's own account describes months of phishing campaigns that followed, and City AM reported that some customers were threatened with home visits unless they paid.

The Ledger list showed only that someone had bought a hardware wallet. Karapetsas' notice, as he shared it, goes further: it ties a named person to specific addresses whose balances anyone can check.

The exposure has limits. For customers who kept only spending money in the card wallet, the visible balance may be small. That protection reaches only as far as the wallets stay separate. Transfers into and out of a card wallet are recorded onchain and can lead to larger addresses, and the published notice listed every linked address rather than one.

What a Convincing Fake Could Look Like

Leaked details weaken the tests people usually apply to a suspicious message. The UK's National Cyber Security Centre warns that criminals use stolen information to make phishing look legitimate. It also warns that publicity around a breach lets them approach people whose data was never taken.

The wind-down hands scammers a ready script. Gnosis Pay's card help page already warns of fake "migrate your Gnosis Pay account" sites, fake partner offers, and strangers offering to help move funds. A message citing a real purchase, a real home address, and the real December 20 date could pass as routine account administration. Last week, a similar tactic put a fake airdrop app in Solana Mobile's featured store slot, where it asked users for recovery phrases.

Gnosis Pay's own statements give customers firm tests to apply. The company says neither it nor its partner apps will ask for a seed phrase, private keys, PIN, or full card number, or ask customers to re-verify their identity by email or text. It also says it does not request transfers of funds by email, text, or phone. The same support guidance says there is no deadline for withdrawing self-custodied funds. Any message tying a transfer to December 20 is therefore false on its face.

If a Breach Notice Reached Your Inbox

Read your own notice through an official route. Open the Gnosis Pay web app or your partner app directly, never through a link in a message, and check which fields your email lists. Gnosis Pay says it recommended extra actions based on the data each account lost. Official partner apps are listed on its Partner Marketplace.

Freeze the card if its number was listed. Freezing is instant and reversible from the app. Reporting the card lost or stolen cancels it permanently, and replacements can only be ordered until December 20. A virtual card can be added instantly in the web app for anyone who still needs to spend.

Check every recent payment. Unrecognized transactions can be disputed. Gnosis Pay says it will keep handling disputes and chargebacks until May 24, 2028, long after the cards stop working.

Start fresh holdings at a new address. Funds received at an address that never appeared in a Gnosis Pay record are not tied to the leak. Set it up in your own wallet app, on your own initiative. Moving funds straight from a linked address leaves an onchain trail, so this narrows the connection rather than erasing it.

Request your full record. Gnosis Pay is a UK-registered company, and UK data protection law entitles individuals to a copy of the personal data a company holds on them. Organisations must generally respond to such requests within one month, and the copy shows exactly what was on file.

What Gnosis Pay Has Not Said Yet

Gnosis Pay has not disclosed three things:

• how many customers were affected;
• when the intrusion began, since November 3 is only the date it was detected;
• whether exposed card data included expiry dates or security codes, which decides how usable the leaked numbers are before December 20.

The company says it is in contact with data protection authorities and its card issuer, and has arranged specialist monitoring for signs that the stolen data is being misused. UK data protection rules require organisations to notify the Information Commissioner's Office, the country's data protection regulator, of a qualifying personal data breach within 72 hours of becoming aware of it. A finding from that monitoring, or a regulator statement, would be the first public confirmation that the data has moved from the breached server into active scams. Reports of fake migration offers quoting real customer details before the December 20 shutdown would point the same way.