Crypto-linked Visa debit card provider Gnosis Pay disclosed a security breach on Friday that exposed customers' payment card details, home addresses and cryptocurrency wallet addresses.

According to an official blog post, the company detected unauthorized access to its legacy consumer card system on Nov. 3 and began containing the breach within two hours. Gnosis Pay said customer funds were unaffected, as was its separate enterprise platform, which powers white-label card programs.

Breach notifications reviewed by Cointelegraph showed that the compromised information included full payment card numbers, expiration dates, CVV codes, customer names, home addresses and wallet addresses linked to affected accounts. The exposed data also included email addresses, phone numbers, nationalities and, in some cases, banking details such as IBAN and BIC information.

The significance of the exposed data varies by category. Full card numbers, expiration dates and CVV codes are typically all that is required to make card-not-present payments online. Wallet addresses, by contrast, are public identifiers on blockchains and do not by themselves grant access to funds, but in this breach they were exposed alongside customer names and home addresses, linking pseudonymous on-chain activity to real-world identities.

A Gnosis Pay customer shared a breach notification detailing the exposed personal and financial data. Source: Lefteris Karapetsas on X

One notification also confirmed that the customer's card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected.

In response, Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system's planned retirement on Dec. 20. 3D Secure requires an additional verification step for online card payments, beyond the static card data exposed in the breach. The company also warned customers about phishing attempts that use their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.

According to data from OpenRate, a third-party platform that tracks crypto card activity, Gnosis Pay had around 2,400 daily active cardholders and processed $263,200 in transactions over the previous 24 hours — figures that offer a sense of the platform's scale.

The company did not disclose how many customers were affected and did not immediately respond to Cointelegraph's request for comment. With the number of affected accounts still unspecified, the company's monitoring for misuse of the stolen data and the Dec. 20 retirement of the legacy card system — the point at which the mandatory 3D Secure requirement is currently set to lapse — are the immediate items to watch.

Source: Cointelegraph